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Presidential  Commission 

on  the 

Space  Shuttle  Challenger  Accident 

June  6,  1986 


Dear  Mr.  President: 

On  behalf  of  the  Commission,  it  is  my  privilege  to  present 
the  report  of  the  Presidential  Commission  on  the  Space  Shuttle 
Challenger  Accident. 

Since  being  sworn  in  on  February  6,  1986,  the  Commission 
has  been  able  to  conduct  a  comprehensive  investigation  of  the 
Challenger  accident.   This  report  documents  our  findings  and 
makes  recommendations  for  your  consideration. 

Our  objective  has  been  not  only  to  prevent  any  recurrence 
of  the  failure  related  to  this  accident,  but  to  the  extent  pos- 
sible to  reduce  other  risks  in  future  flights.   However,  the 
Commission  did  not  construe  its  mandate  to  require  a  detailed 
evaluation  of  the  entire  Shuttle  system.   It  fully  recognizes 
that  the  risk  associated  with  space  flight  cannot  be  totally 
eliminated . 

Each  member  of  the  Commission  shared  the  pain  and  anguish 
the  nation  felt  at  the  loss  of  seven  brave  Americans  in  the 
Challenger  accident  on  January  28,  1986. 

The  nation's  task  now  is  to  move  ahead  to  return  to  safe 
space  flight  and  to  its  recognized  position  of  leadership  in 
space.   There  could  be  no  more  fitting  tribute  to  the  Challenger 
crew  than  to  do  so. 


Sincerely, 


William  P.  Rogers 
Chairman 


The  President  of  the  United  States 
The  White  House 
Washington,  D.  C.   20500 


f*X)  Maryland  Avenue,  S.W.  Washington,  DC.  20024  (202)453-1405 
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Preface 


The  accident  of  Space  Shuttle 
Challenger,  mission  51-L,  interrupt- 
ing for  a  time  one  of  the  most  pro- 
ductive engineering,  scientific  and  ex- 
ploratory programs  in  history,  evoked  a  wide 
range  of  deeply  felt  public  responses.  There  was 
grief  and  sadness  for  the  loss  of  seven  brave 
members  of  the  crew;  firm  national  resolve  that 
those  men  and  women  be  forever  enshrined  in 
the  annals  of  American  heroes,  and  a  determina- 
tion, based  on  that  resolve  and  in  their  memory, 
to  strengthen  the  Space  Shuttle  program  so  that 
this  tragic  event  will  become  a  milestone  on  the 
way  to  achieving  the  full  potential  that  space  of- 
fers to  mankind. 

The  President,  who  was  moved  and  troubled 
by  this  accident  in  a  very  personal  way,  appointed 
an  independent  Commission  made  up  of  persons 
not  connected  with  the  mission  to  investigate  it. 
The  mandate  of  the  Commission  was  to: 

1 .  Review  the  circumstances  surrounding  the 
accident  to  establish  the  probable  cause  or  causes 
of  the  accident;  and 

2 .  Develop  recommendations  for  corrective  or 
other  action  based  upon  the  Commission's  find- 
ings and  determinations. 

Immediately  after  being  appointed,  the  Com- 
mission moved  forward  with  its  investigation  and, 
with  the  full  support  of  the  White  House,  held 
public  hearings  dealing  with  the  facts  leading  up 
to  the  accident.  In  a  closed  society  other  options 
are  available;  in  an  open  society  — unless  classified 
matters  are  involved  — other  options  are  not, 
either  as  matter  of  law  or  as  a  practical  matter. 

In  this  case  a  vigorous  investigation  and  full 
disclosure  of  the  facts  were  necessary.  The  way 
to  deal  with  a  failure  of  this  magnitude  is  to 
disclose  all  the  facts  fully  and  openly;  to  take  im- 
mediate steps  to  correct  mistakes  that  led  to  the 
failure;  and  to  continue  the  program  with  re- 
newed confidence  and  determination. 

The  Commission  construed  its  mandate 
somewhat  broadly  to  include  recommendations 
on  safety  matters  not  necessarily  involved  in  this 


accident  but  which  require  attention  to  make 
future  flights  safer.  Careful  attention  was  given 
to  concerns  expressed  by  astronauts  because  the 
Space  Shuttle  program  will  only  succeed  if  the 
highly  qualified  men  and  women  who  fly  the 
Shuttle  have  confidence  in  the  system. 

However,  the  Commission  did  not  construe  its 
mandate  to  require  a  detailed  investigation  of  all 
aspects  of  the  Space  Shuttle  program;  to  review 
budgetary  matters;  or  to  interfere  with  or 
supersede  Congress  in  any  way  in  the  perform- 
ance of  its  duties.  Rather,  the  Commission 
focused  its  attention  on  the  safety  aspects  of  future 
flights  based  on  the  lessons  learned  from  the  in- 
vestigation with  the  objective  being  to  return  to 
safe  flight. 

Congress  recognized  the  desirability,  in  the  first 
instance,  of  having  a  single  investigation  of  this 
national  tragedy.  It  very  responsibly  agreed  to 
await  the  Commission's  findings  before  deciding 
what  further  action  might  be  necessary  to  carry 
out  its  responsibilities. 

For  the  first  several  days  after  the  accident  — 
possibly  because  of  the  trauma  resulting  from  the 
accident  — NASA  appeared  to  be  withholding  in- 
formation about  the  accident  from  the  public. 
After  the  Commission  began  its  work,  and  at  its 
suggestion,  NASA  began  releasing  a  great  deal 
of  information  that  helped  to  reassure  the  public 
that  all  aspects  of  the  accident  were  being  in- 
vestigated and  that  the  full  story  was  being  told 
in  an  orderly  and  thorough  manner. 

Following  the  suggestion  of  the  Commission, 
NASA  established  several  teams  of  persons  not 
involved  in  the  mission  51-L  launch  process  to 
support  the  Commission  and  its  panels.  These 
NASA  teams  have  cooperated  with  the  Commis- 
sion in  every  aspect  of  its  work.  The  result  has 
been  a  comprehensive  and  complete  investiga- 
tion. 

The  Commission  believes  that  its  investigation 
and  report  have  been  responsive  to  the  request 
of  the  President  and  hopes  that  they  will  serve 
the  best  interests  of  the  nation  in  restoring  the 
United  States  space  program  to  its  preeminent 
position  in  the  world.  ■ 
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Chapter  I 


Introduction 


The  Space  Shuttle  concept  had  its 
genesis  in  the  1960s,  when  the  Apollo 
lunar  landing  spacecraft  was  in  full 
development  but  had  not  yet  flown. 
From  the  earliest  days  of  the  space  program,  it 
seemed  logical  that  the  goal  of  frequent, 
economical  access  to  space  might  best  be  served 
by  a  reusable  launch  system.  In  February,  1967, 
the  President's  Science  Advisory  Committee  lent 
weight  to  the  idea  of  a  reusable  spacecraft  by 
recommending  that  studies  be  made  "of  more 
economical  ferrying  systems,  presumably  involv- 
ing partial  or  total  recovery  and  use." 

In  September,  1969,  two  months  after  the  in- 
itial lunar  landing,  a  Space  Task  Group  chaired 
by  the  Vice  President  offered  a  choice  of  three 
long-range  plans: 

■  A  $8-$  10  billion  per  year  program  involv- 
ing a  manned  Mars  expedition,  a  space  sta- 
tion in  lunar  orbit  and  a  50-person  Earth- 
orbiting  station  serviced  by  a  reusable  ferry, 
or  Space  Shuttle. 

■  An  intermediate  program,  costing  less  than 
$8  billion  annually,  that  would  include  the 
Mars  mission. 

■  A  relatively  modest  $4-$5.7  billion  a  year 
program  that  would  embrace  an  Earth- 
orbiting  space  station  and  the  Space  Shut- 
tle as  its  link  to  Earth.1 

In  March,  1970,  President  Nixon  made  it  clear 
that,  while  he  favored  a  continuing  active  space 
program,  funding  on  the  order  of  Apollo  was  not 
in  the  cards.  He  opted  for  the  shuttle-tended  space 
base  as  a  long-range  goal  but  deferred  going 
ahead  with  the  space  station  pending  develop- 
ment of  the  shuttle  vehicle.  Thus  the  reusable 


Space  Shuttle,  earlier  considered  only  the 
transport  element  of  a  broad,  multi-objective 
space  plan,  became  the  focus  of  NASA's  near- 
term  future. 


The  Space  Shuttle  Design 

The  embryo  Shuttle  program  faced  a  number 
of  evolutionary  design  changes  before  it  would 
become  a  system  in  being.  The  first  design  was 
based  on  a  "fly  back"  concept  in  which  two  stages, 
each  manned,  would  fly  back  to  a  horizontal, 
airplane-like  landing.  The  first  stage  was  a  huge, 
winged,  rocket-powered  vehicle  that  would  carry 
the  smaller  second  stage  piggyback;  the  carrier 
would  provide  the  thrust  for  liftoff  and  flight 
through  the  atmosphere,  then  release  its 
passenger  — the  orbiting  vehicle  — and  return  to 
Earth.  The  Orbiter,  containing  the  crew  and 
payload,  would  continue  into  space  under  its  own 
rocket  power,  complete  its  mission  and  then  fly 
back  to  Earth. 

The  second-stage  craft,  conceived  prior  to  1970 
as  a  space  station  ferry,  was  a  vehicle  considerably 
larger  than  the  later  Space  Shuttle  Orbiter.  It  car- 
ried its  rocket  propellants  internally,  had  a  flight 
deck  sufficiently  large  to  seat  12  space  station- 
bound  passengers  and  a  cargo  bay  big  enough 
to  accommodate  space  station  modules.  The  Or- 
biter's  size  put  enormous  weightlifting  and  thrust- 
generating  demands  on  the  first-stage  design. 

This  two-stage,  fully  reusable  design 
represented  the  optimum  Space  Shuttle  in  terms 
of  "routine,  economical  access  to  space,"  the  catch- 
phrase  that  was  becoming  the  primary  guideline 
for  development  of  Earth-to-orbit  systems.  It  was, 


however,  less  than  optimum  in  terms  of  the 
development  investment  required:  an  estimated 
$10-13  billion,  a  figure  that  met  with  disfavor  in 
both  Congress  and  the  Office  of  Management  and 
Budget. 

In  1971,  NASA  went  back  to  the  drawing 
board,  aware  that  development  cost  rather  than 
system  capability  would  probably  be  the  deter- 
mining factor  in  getting  a  green  light  for  Shuttle 
development.  Government  and  industry  studies 
sought  developmental  economies  in  the  con- 
figuration. One  proposal  found  acceptance: 
eliminate  the  Orbiter's  internal  tanks  and  carry 
the  propellant  in  a  single,  disposable  External 
Tank.  It  provided  a  smaller,  cheaper  Orbiter 
without  substantial  performance  loss. 


For  the  launch  system,  NASA  examined  a 
number  of  possibilities.  One  was  a  winged  but 
unmanned  recoverable  liquid-fuel  vehicle  based 
on  the  eminently  successful  Saturn  5  rocket  from 
the  Apollo  Program.  Other  plans  envisioned 
simpler  but  also  recoverable  liquid-fuel  systems, 
expendable  solid  rockets  and  the  reusable  Solid 
Rocket  Booster.  NASA  had  been  using  solid-fuel 
vehicles  for  launching  some  small  unmanned 
spacecraft,  but  solids  as  boosters  for  manned  flight 
was  a  technology  new  to  the  agency.  Mercury, 
Gemini  and  Apollo  astronauts  had  all  been 
rocketed  into  space  by  liquid-fuel  systems. 
Nonetheless,  the  recoverable  Solid  Rocket 
Booster  won  the  nod,  even  though  the  liquid 
rocket  offered  potentially  lower  operating  costs. 


Artist's  drawing  depicts  Space  Shuttle  stacked  for  launch  in 
view  from  dorsal  side  of  Orbiter  (left)  and  from  the  left  side 
of  stack. 


The  overriding  reason  was  that  pricing  estimates 
indicated  a  lower  cost  of  development  for  the  solid 
booster. 

Emerging  from  this  round  of  design  decision 
making  was  the  Space  Shuttle:  a  three-element 
system  composed  of  the  Orbiter,  an  expendable 
external  fuel  tank  carrying  liquid  propellants  for 
the  Orbiter's  engines,  and  two  recoverable  Solid 
Rocket  Boosters.  It  would  cost,  NASA  estimated 
early  in  1972,  $6.2  billion  to  develop  and  test  a 
five-Orbiter  Space  Shuttle  system,  about  half 
what  the  two-stage  "fly  back"  design  would  have 
cost.  To  achieve  that  reduction,  NASA  had  to 
accept  somewhat  higher  system  operating  costs 
and  sacrifice  full  reusability.  The  compromise 
design  retained  recoverability  and  reuse  of  two 
of  the  three  elements  and  still  promised  to  trim 
substantially  the  cost  of  delivering  payloads  to 
orbit. 

The  final  configuration  was  selected  in  March, 
1972. 


The  Space  Shuttle 
Development 

In  August,  1972,  NASA  awarded  a  contract 
to  Rockwell  International  Corporation's  Space 
Transportation  Systems  Division  for  design  and 
development  of  the  Space  Shuttle  Orbiter.  Mar- 
tin Marietta  Denver  Aerospace  was  assigned 
development  and  fabrication  of  the  External 
Tank,  Morton  Thiokol  Corporation  was  award- 
ed the  contract  for  the  Solid  Rocket  Boosters,  and 
Rocketdyne,  a  division  of  Rockwell,  was  selected 
to  develop  the  Orbiter  main  engines. 

NASA  divided  managerial  responsibility  for 
the  program  among  three  of  its  field  centers. 
Johnson  Space  Center,  Houston,  Texas,  was 
assigned  management  of  the  Orbiter.  Marshall 
Space  Flight  Center,  Huntsville,  Alabama,  was 
made  responsible  for  the  Orbiter's  main  engines, 
the  External  Tank  and  the  Solid  Rocket  Boosters. 
Kennedy  Space  Center,  Merritt  Island,  Florida, 
was  given  the  job  of  assembling  the  Space  Shut- 
tle components,  checking  them  out  and  conduct- 
ing launches.  Because  these  three  centers  will  be 
mentioned  repeatedly  in  this  report,  they  will 
hereafter  be  identified  simply  as  Johnson,  Mar- 
shall and  Kennedy. 

It  was  in  an  increasingly  austere  fiscal  environ- 


ment that  NASA  struggled  through  the  Shuttle 
development  years  of  the  1970s.  The  planned 
five-Orbiter  fleet  was  reduced  to  four.  Budgetary 
difficulties  were  compounded  by  engineering 
problems  and,  inevitably  in  a  major  new  system 
whose  development  pushes  the  frontiers  of 
technology,  there  was  cost  growth.  This  combina- 
tion of  factors  induced  schedule  slippage.  The  ini- 
tial orbital  test  flights  were  delayed  by  more  than 
two  years. 

The  first  Shuttle  test  flights  were  conducted  at 
Dryden  Flight  Research  Facility,  California,  in 
1977.  The  test  craft  was  the  Orbiter  Enterprise, 
a  full-size  vehicle  that  lacked  engines  and  other 
systems  needed  for  orbital  flight.  The  purpose  of 
these  tests  was  to  check  out  the  aerodynamic  and 
flight  control  characteristics  of  the  Orbiter  in  at- 
mospheric flight.  Mounted  piggyback  atop  a 
modified  Boeing  747,  the  Enterprise  was  carried 
to  altitude  and  released  for  a  gliding  approach 
and  landing  at  the  Mojave  Desert  test  center.  Five 
such  flights  were  made.  They  served  to  validate 
the  Orbiter's  computers  and  other  systems.  They 
also  demonstrated  the  craft's  subsonic  handling 
qualities,  in  particular  its  performance  in  the 
precise  unpowered  landings  that  would  be  re- 
quired on  all  Shuttle  flights. 

The  Enterprise  test  flights  were  followed  —  in 
1977-80  — by  extensive  ground  tests  of  Shuttle 
systems,  including  vibration  tests  of  the  entire 
assembly  — Orbiter,  External  Tank  and  Solid 
Rocket  Boosters  — at  Marshall.  Main  engine  test 
firings  were  conducted  at  National  Space 
Technology  Laboratories  at  Bay  St.  Louis, 
Mississippi,  and  on  the  launch  pad  at  Kennedy. 

By  early  1981,  the  Space  Shuttle  was  ready  for 
an  orbital  flight  test  program.  This  was  careful- 
ly crafted  to  include  more  than  1,000  tests  and 
data  collection  procedures.  All  flights  were  to  be 
launched  from  Kennedy  and  terminate  at  Ed- 
wards Air  Force  Base,  where  the  Dryden  Flight 
Research  Facility  is  located  (actually  the  third 
flight  landed  at  White  Sands  Test  Facility,  New 
Mexico,  because  the  normally  dry  lakebed  at  Ed- 
wards was  flooded).  Originally  intended  as  a  six- 
mission  program,  the  orbital  test  series  was  reduc- 
ed to  four  flights: 

■  STS-1  (Space  Transportation  System— 1), 
April  12-14,  1981,  Orbiter  Columbia,  was 
a  two-day  demonstration  of  the  Orbiter's 
ability  to  go  into  orbit  and  return  safely.  Its 


main  payload  was  a  flight  instrumentation 
pallet  containing  equipment  for  recording 
temperatures,  pressures  and  acceleration 
levels  at  various  points  around  the  Orbiter. 
In  addition,  there  were  checkouts  of  the 
cargo  bay  doors,  attitude  control  system  and 
orbital  maneuvering  system. 

■  STS-2,  November  12-14,  1981,  Orbiter 
Columbia,  marked  the  first  test  of  the 
Remote  Manipulator  System  and  carried  a 
payload  of  Earth  survey  instruments.  This 
was  the  first  time  any  spacecraft  had  flown 
twice.  Failure  of  a  fuel  cell  shortened  the 
flight  by  about  three  days. 

■  STS-3,  March  22-30,  1982,  Orbiter  Colum- 
bia, was  the  longest  of  the  initial  test  series, 
staying  aloft  eight  days.  Activities  included 
a  special  test  of  the  manipulator  in  which 
the  robot  arm  removed  a  package  of  in- 
struments from  the  payload  bay  but  did  not 
release  it  into  space.  The  flight  included  ex- 
periments in  materials  processing. 

■  STS-4,  June  27-July  4,  1982,  Orbiter  Co- 
lumbia, featured  another  test  of  the  robot 
arm,  which  extended  a  scientific  payload 
over  the  side  of  the  payload  bay,  then  re- 
berthed  it.  Materials  processing  experiments 
were  conducted,  as  were  a  number  of  scien- 
tific investigations.  This  flight  carried  the 
first  Department  of  Defense  payload. 

With  the  landing  of  STS-4,  the  orbital  flight 
test  program  came  to  an  end  with  95  percent  of 
its  objectives  accomplished.  The  interval  between 
flights  had  been  trimmed  from  seven  months  to 
four,  then  three.  NASA  declared  the  Space  Shut- 
tle "operational,"  a  term  that  has  encountered 
some  criticism  because  it  erroneously  suggests 
that  the  Shuttle  had  attained  an  airline-like  degree 
of  routine  operation.  In  any  event,  NASA  regard- 
ed all  flights  after  STS-4  operational  in  the  sense 
that  payload  requirements  would  take  precedence 
over  spacecraft  testing,  requiring  larger  crews. 

After  completing  the  orbital  test  in  mid- 1982, 
NASA  began  the  "operational  phase"  of  the  Space 
Shuttle  program,  beginning  with  STS-5.  The 
STS  —  for  Space  Transportation  System  — 
sequential  numbering  was  still  in  effect  at  that 
time;  after  STS-9  NASA  changed  the  method  of 
numbering  missions.  Thereafter  each  flight  was 
designated  by  two  numbers  and  a  letter,  such  as 
41-B.  The  first  digit  indicates  the  fiscal  year  of 
the  scheduled  launch  (4  for  1984).  The  second 


digit  identifies  the  launch  site  (1  is  Kennedy,  2 
Vandenberg  Air  Force  Base,  California).  The  let- 
ter corresponds  to  the  alphabetical  sequence  for 
the  fiscal  year,  B  being  the  second  mission 
scheduled.  Here  is  a  brief  summary  of  the  21  mis- 
sions launched  from  late  1982  to  January,  1986: 

■  STS-5,  November  11-16,  1982,  Orbiter 
Columbia,  launched  two  communications 
satellites,  which  later  were  boosted  to 
geosynchronous  orbit  by  attached  propul- 
sion systems. 

■  STS-6,  April  4-9,  1983,  Orbiter  Challenger, 
was  highlighted  by  the  first  Shuttle-based 
spacewalk,  or  extravehicular  activity.  The 
crew  successfully  deployed  the  5,000-pound 
Tracking  and  Data  Relay  Satellite,  first  of 
three  planned  NASA  communications 
satellites. 

■  STS-7,  June  18-24,  1983,  Orbiter 
Challenger,  delivered  a  second  pair  of  com- 
mercial communications  satellites.  The  mis- 
sion also  included  additional  payload  release 
and  recapture  tests  using  the  Remote 
Manipulator  System.  This  flight  marked  the 
first  retrieval  of  an  object  from  orbit. 

■  STS-8,  August  30-September  6,  1983,  Or- 
biter Challenger,  included  more  robot  arm 
tests  plus  deployment  of  a  commer- 
cial/public service  communications  satellite. 

■  STS-9,  November  28-December  8,  1983, 
Orbiter  Columbia,  carried  the  first  Spacelab 
in  the  payload  bay.  The  mission  marked 
Columbia's  return  to  service  after  a  year's 
hiatus,  during  which  it  had  been  extensive- 
ly modified. 

■  Flight  10  (41-B),  February  3-11,  1984,  Or- 
biter Challenger,  was  highlighted  by  the  in- 
troduction of  the  Manned  Maneuvering 
Unit,  a  backpack  propulsion  unit  that  allows 
astronauts  to  maneuver  in  space  independ- 
ent of  the  Orbiter.  The  mission  also 
launched  two  communications  satellites,  but 
their  boosters  failed  to  put  them  into  geosyn- 
chronous orbit.  For  the  first  time,  the  Shut- 
tle landed  on  the  concrete  runway  at  Ken- 
nedy Space  Center. 

■  Flight  1 1  (41 -C),  April  6-13,  1984,  Orbiter 
Challenger,  featured  an  important 
demonstration  of  Shuttle  ability:  the 
retrieval,  repair  and  redeployment  of  the 
malfunctioning  Solar  Maximum  Mission 
spacecraft    with    the    help    of   a    Manned 


Maneuvering  Unit.  Other  activity  includ- 
ed deployment  of  the  Long  Duration  Ex- 
posure Facility,  a  large  cylinder  containing 
materials  samples  to  be  retrieved  and  ex- 
amined after  long  exposure  to  the  space 
environment. 
Flight  12  (41-D),  August  30-September  5, 

1984,  Orbiter  Discovery,  was  devoted 
primarily  to  launch  of  three  communications 
satellites.  The  mission  demonstrated 
repeated  deployment  and  retraction  of  a 
large,  foldable  solar  array  to  investigate  the 
practicability  of  using  such  solar  wings  as 
power  sources  for  extended  Shuttle  mis- 
sions, space  platforms  or  the  space  station. 
Flight  13  (41-G),  October  5-13,  1984,  Or- 
biter Challenger,  launched  the  NASA  Earth 
Radiation  Budget  Explorer.  A  cargo  bay 
pallet  carried  instruments  for  Earth  obser- 
vations, including  an  advanced  imaging 
radar. 

Flight  14  (51 -A),  November  8-16,  1984,  Or- 
biter Discovery,  launched  two  communica- 
tions satellites  and  retrieved  two  others  that 
had  been  sent  into  unusable  orbits  after 
deployment  on  Flight  10. 
Flight  15  (51-C),  January  24-27,  1985,  Or- 
biter Discovery,  carried  a  Department  of 
Defense  payload. 

Flight  16  (51-D),  April  12-19,  1985,  Orbiter 
Discovery,  deployed  two  commercial 
satellites;  one,  Leasat-3,  remained  in  low  or- 
bit when  the  upper  stage  booster  failed  to 
activate. 

Flight  17  (51-B),  April  29-May  6,  1985,  Or- 
biter Challenger,  carried  a  second  Spacelab 
mission  and  materials  processing 
experiments. 

Flight  18  (51-G),  June  17-24,  1985,  Orbiter 
Discovery,  delivered  three  communications 
satellites,  deployed  a  low-cost  Spartan  scien- 
tific satellite  and  retrieved  it  after  a  period 
of  free  flight. 

Flight  19  (51-F),  July  29-August  6,  1985, 
Orbiter  Challenger,  carried  the  third 
Spacelab  mission,  which  covered  a  broad 
range  of  experiments  in  plasma  physics, 
astrophysics,  solar  astronomy  and  materials 
processing. 
Flight  20  (51-1),  August  27-September  3, 

1985,  Orbiter  Discovery,  deployed  three 
communications   satellites.    The   Leasat-3 


satellite  which  failed  to  activate  after  deploy- 
ment on  Flight  16  was  retrieved,  repaired 
and  successfully  redeployed. 

■  Flight  21  (51-J),  October  3-10,  1985,  Or- 
biter Atlantis  was  devoted  to  another 
Department  of  Defense  mission. 

■  Flight  22  (61 -A),  October  30-November  6, 
1985,  Orbiter  Challenger,  carried  the  fourth 
Spacelab  mission,  devoted  to  materials  proc- 
essing experimentation. 

■  Flight  23  (61-B),  November  26-December 
3,  1985,  Orbiter  Atlantis,  was  highlighted 
by  an  experiment  in  astronaut  assembly  of 
structures  in  orbit  and  attendant  study  of 
extravehicular  dynamics  and  human  factors. 
The  mission  also  deployed  three  com- 
munications satellites. 

■  Flight  24  (61-C),  January  12-18,  1986,  Or- 
biter Columbia,  launched  a  commercial 
communications  satellite,  deployed  a  Hitch- 
hiker secondary  payload,  conducted  ex- 
periments in  infrared  imaging,  acquired 
photos  and  spectral  images  of  Comet 
Halley. 

■  Flight  25  (5 1-L),  January  28,  1986,  Orbiter 
Challenger.  The  accident. 

Including  the  initial  orbital  tests,  the  Space 
Shuttle  flew  24  successful  missions  over  a 
57-month  period.  Columbia  made  seven  trips  into 
space,  Discovery  six  and  Atlantis  two.  Challenger 
flew  most  frequently  — nine  times  prior  to  its 
fateful  last  flight. 

In  those  24  flights,  the  Shuttle  demonstrated 
its  ability  to  deliver  a  wide  variety  of  payloads; 
its  ability  to  serve  as  an  orbital  laboratory;  its 
utility  as  a  platform  for  erection  of  large  struc- 
tures; and  its  use  for  retrieval  and  repair  of  or- 
biting satellites. 

Elements  of  the 
Space  Shuttle 

The  Space  Shuttle  is  the  principal  component 
of  a  national  Space  Transportation  System 
designed  to  accommodate  not  only  NASA's 
predictable  needs  but  also  those  of  the  Depart- 
ment of  Defense  and  commercial  payload  spon- 
sors. Technically  speaking,  transportation  system 
hardware  embraces  not  only  the  Shuttle  but  its 
Spacelab  laboratory  component,  the  upper  stage 
propulsion  units,  contemplated  heavy  lift  vehicles 


and  space  tugs  for  moving  payloads  from  one  or- 
bit to  another.  To  provide  for  the  broadest  possi- 
ble spectrum  of  civil/military  missions,  the  Space 
Shuttle  was  designed  to  deliver  65,000  pounds  of 
payload  to  an  easterly  low  Earth  orbit  or  32,000 
pounds  to  polar  orbit.  The  following  sections 
describe  the  main  elements  of  the  Shuttle  system. 

The  Orbiter 

The  Orbiter  is  as  large  as  a  mid-size  airline 
transport  and  has  a  structure  like  that  of  an  air- 
craft: an  aluminum  alloy  skin  stiffened  with 
stringers  to  form  a  shell  over  frames  and 
bulkheads  of  aluminum  or  aluminum  alloy.  The 
major  structural  sections  of  the  Orbiter  are  the 
forward  fuselage,  which  encompasses  the 
pressurized  crew  compartment;  the  mid  fuselage, 
which  contains  the  payload  bay;  the  payload  bay 
doors;  the  aft  fuselage,  from  which  the  main 
engine  nozzles  project;  and  the  vertical  tail,  which 
splits  open  along  the  trailing  edge  to  provide  a 
speed  brake  used  during  entry  and  landing. 

The  crew  compartment  is  divided  into  two 
levels  — the  flight  deck  on  top  and  the  middeck 
below.  Besides  working  space,  the  crew  compart- 
ment contains  the  systems  needed  to  provide  a 
habitable  environment  (atmosphere,  tempera- 
ture, food,  water,  the  crew  sleep  facilities  and 
waste  management).  It  also  houses  the  electronic, 
guidance  and  navigation  systems. 

The  Orbiter  crew  may  include  as  many  as  eight 
people,  although  generally  the  limit  is  seven.  The 
crew  consists  of  the  commander,  the  captain  of 
the  ship;  the  pilot,  second  in  command;  and  two 
or  more  mission  specialists.  One  or  more  payload 
specialists  can  also  be  accommodated.  A  mission 
specialist  coordinates  activities  of  the  Orbiter  and 
crew  in  support  of  a  given  payload  objective.  A 
payload  specialist  may  manage  specific  ex- 
periments. The  commander,  pilot  and  mission 
specialists  are  career  astronauts  assigned  to  the 
mission  by  NASA.  Payload  specialists  do  not 
come  from  the  Astronaut  Office.  They  are  as- 
signed, by  payload  sponsors  in  coordination  with 
NASA. 

Cargoes  up  to  24  tons  have  been  carried  in  the 
payload  bay.  Clamshell  doors  on  the  top  of  the 
Orbiter  meet  along  the  craft's  spine  to  enclose  the 
bay,  which  is  15  feet  wide  and  60  feet  long. 

The  payload  bay  is  designed  to  hold  securely 
a  wide  range  of  objects.  They  may  include  one 
or  more  communications  satellites  to  be  launch- 
ed from  orbit,  an  autonomous  Spacelab  for  ex- 


periments in  space,  or  cargo  disposed  on  special 
pallets.  To  handle  cargo  in  orbital  flight,  the 
payload  bay  has  the  50-foot  mechanical  arm  that 
is  controlled  from  within  the  crew  compartment. 
A  television  camera  and  lights  mounted  near  the 
end  of  the  arm  enable  the  operator  to  see  what 
the  "hand"  is  doing. 

Just  as  important  as  delivering  cargo  to  orbit 
is  recovering  a  satellite  and  bringing  it  back  to 
Earth  — retrieving  a  satellite  in  need  of  refurbish- 
ment, for  example.  The  Orbiter  can  carry  16  tons 
of  cargo  back  from  space. 

The  feasibility  of  a  reusable  Space  Shuttle 
hinges  on  a  particularly  vital  requirement:  pro- 
tecting the  Orbiter  from  the  searing  heat 
generated  by  friction  with  the  atmosphere  when 
the  craft  returns  to  Earth.  Temperatures  during 
entry  may  rise  as  high  as  2,750  degrees 
Fahrenheit  on  the  leading  edge  of  the  wing  and 
600  degrees  on  the  upper  fuselage,  the  "coolest" 
area.  The  thermal  protection  system  devised  for 
the  Orbiter  must  prevent  the  temperature  of  the 
aluminum  skin  from  rising  above  350  degrees 
during  either  ascent  or  entry. 

The  Orbiter  has  four  kinds  of  external  insula- 
tion that  are  applied  to  various  parts  of  the  struc- 
ture according  to  the  temperature  each  is  likely 
to  experience.  The  craft's  nose  cap  and  the  leading 
edges  of  the  wings  are  protected  with  an  all- 
carbon  composite  consisting  of  layers  of  graphite 
cloth  in  a  carbon  matrix.  The  outer  layers  are 
converted  chemically  to  silicon  carbide,  the  same 
material  that  has  long  been  used  as  an  abrasive 
in  grindstones.  Areas  subjected  to  the  next 
greatest  heat  are  shielded  with  high-temperature 
ceramic  tiles  about  six  inches  square  and  vary- 
ing in  thickness  from  one  to  five  inches,  depen- 
ding on  the  protection  needed.  So-called  "low- 
temperature"  tiles  are  of  the  same  material  — 
nearly  pure  glass,  of  which  90  percent  of  the 
volume  is  "air"  — for  use  on  areas  requiring  less 
protection.  (Low-temperature  is  relative;  tiles  so 
designated  can  withstand  a  temperature  of  1 ,200 
degrees  Fahrenheit.)  About  30,000  tiles,  each  dif- 
ferent, are  installed  on  each  Orbiter. 

Space  Shuttle  Main  Engines 

The  three  high-performance  rocket  engines  in 
the  aft  section  of  the  Orbiter  fire  for  about  the 
first  8  V2  minutes  of  flight  after  liftoff.  At  sea  level, 
each  engine  generates  375,000  pounds  of  thrust 
at  100  percent  throttle. 

The  propellants  for  the  engines  are  the  fuel  (liq- 


uid  hydrogen)  and  the  oxidizer  (liquid  oxygen) 
(arried  in  the  External  Tank.  Combustion  takes 
place  in  two  stages.  First,  the  propellants  are  mix- 
ed and  partly  burned  in  pre-burners.  Hot  gases 
from  the  pre-burners  drive  the  high-pressure  tur- 
bopumps  which  deliver  propellants  to  the  main 
injector.  Combustion,  once  initiated  by  electrical 
igniters,  is  self-sustaining.  Before  firing,  the  very 
cold  liquid  propellant  is  allowed  to  flow  into  the 
system  as  far  as  the  pre-burners  and  combustion 
chamber  to  cool  the  pumps  and  ducts  so  that  the 
hydrogen  and  oxygen  in  the  system  will  remain 
liquid  when  the  engine  is  started. 

The  main  engines  have  been  throttled  over  a 
range  of  65  to  104  percent  of  the  thrust  at  sea 
level.  At  liftoff,  they  are  thrusting  at  100  percent. 
Computers  command  engine  thrust  to  104  per- 
cent as  soon  as  the  Shuttle  clears  the  tower.  They 
throttle  to  65  percent  to  reduce  the  maximum 
aerodynamic  loads  that  occur  at  an  altitude  of 
about  34,000  feet.  Thereafter,  the  thrust  is  again 
increased  to  provide  an  acceleration  of  three  times 
that  of  gravitv  in  the  last  minute  or  so  of  powered 
flight. 

External  Tank 

The  External  Tank  carries  the  propellants  for 
the  Orbiter's  main  engines—  143,000  gallons  of 
liquid  oxygen  and  383,000  gallons  of  liquid 
hydrogen,  which  is  much  lighter  than  a  com- 
parable volume  of  oxygen.  Together,  the  pro- 
pellants weigh  a  little  more  than  790  tons.  Mar- 
tin Marietta  Denver  Aerospace,  Michoud,  Loui- 
siana, builds  the  tank,  a  welded  aluminum  alloy 
cylinder  with  an  ogive  nose  and  a  hemispherical 
tail.  It  is  154  feet  long  and  27  Vi  feet  in  diameter. 

Because  the  Orbiter  and  the  two  Solid  Rocket 
Boosters  are  attached  to  it  at  liftoff,  the  External 
Tank  absorbs  the  thrust  of  the  combined  propul- 
sion system.  It  withstands  complex  load  effects 
and  pressures  from  the  propellants. 

The  liquid  oxygen  tank  forms  the  nose  of  the 
Externa]  Tank.  It  contains  oxidizer  kept  liquid 
at  a  temperature  of  -  297  degrees  Fahrenheit.  A 
removable  conical  nose  cap  acts  as  an 
aerodynamic  fairing.  Inside  the  tank,  baffles 
reduce  sloshing  and  the  associated  control  prob- 
lems. The  liquid  hydrogen  tank  docs  not  need 
baffles  because  the  fuel  is  so  light  that  sloshing 
does  not  induce  significant  forces.  The  liquid 
hydrogen  tank  accounts  for  the  greater  part  of 
the  External  Tank.  Its  contents  are  even  colder 
than  the  LOX:    -423  degrees  Fahrenheit. 
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The  intertank  structure  or  "intertank"  connects 
the  two  propellant  tanks.  It  is  a  cylindrical  struc- 
tural section  that  houses  instruments  and  receives 
and  distributes  most  of  the  thrust  load  from  the 
Solid  Rocket  Boosters.  The  front  end  of  each 
booster  is  connected  to  the  External  Tank  at  the 
intertank  midsection. 

A  multilayered  thermal  coating  covers  the  out- 
side of  the  External  Tank  to  protect  it  from  ex- 
treme temperature  variations  during  pre-launch, 
launch,  and  the  first  8H>  minutes  of  flight.  That 
insulation  reduces  the  boil-off  rate  of  the  pro- 
pellants, which  must  be  kept  at  very  low 
temperatures  to  remain  liquid.  It  also  is  meant 
to  minimize  ice  that  might  form  from  condensa- 
tion on  the  outside  of  the  propellant  tanks. 

In  addition  to  the  Solid  Rocket  Booster  forward 
attachment  points  on  either  side  of  the  intertank, 
three  other  attachment  points  link  each  booster 
to  the  aft  major  ring  frame  of  the  External  Tank. 
The  boosters  are  thus  connected  to  the  tank  at 
four  points,  one  forward  and  three  aft. 

Three  structural  elements  link  the  Orbiter  to 
the  External  Tank.  A  "wishbone"  attachment 
beneath  the  crew  compartment  connects  the  for- 
ward end  of  the  Orbiter  to  the  tank.  The  two  aft 
connections  are  tripods  at  the  base  of  the  Exter- 
nal Tank. 

A  command  from  the  Orbiter  computer  jet- 
tisons the  External  Tank  18  seconds  after  main 
engine  cutoff,  about  8  Vi  minutes  after  liftoff.  To 
ensure  that  it  will  travel  a  predictable  path,  a  tum- 
ble system  rotates  the  tank  end-over-end  at  a 
minimum  rate  of  two  revolutions  per  minute.  The 
tank  breaks  up  upon  atmospheric  entry,  falling 
into  the  planned  area  of  the  Indian  or  Pacific 
Ocean  about  an  hour  after  liftoff.  The  External 
Tank  is  the  only  main  component  of  the  Space 
Shuttle  that  is  not  recovered  and  reused. 

Solid  Rocket  Boosters 

The  two  solid-propellant  rocket  boosters  are 
almost  as  long  as  the  External  Tank  and  attached 
to  each  side  of  it.  They  contribute  about  80  per- 
cent of  the  total  thrust  at  liftoff;  the  rest  comes 
from  the  Orbiter's  three  main  engines.  Roughly 
two  minutes  after  liftoff  and  24  miles  down  range, 
the  solid  rockets  have  exhausted  their  fuel.  Ex- 
plosives separate  the  boosters  from  the  External 
Tank.  Small  rocket  motors  move  them  away  from 
the  External  Tank  and  the  Orbiter,  which  con- 
tinue toward  orbit  under  thrust  of  the  Shuttle's 
main  engines. 


The  Solid  Rocket  Booster  is  made  up  of  several 
subassemblies:  the  nose  cone,  Solid  Rocket  Motor 
and  the  nozzle  assembly.  Marshall  is  responsi- 
ble for  the  Solid  Rocket  Booster;  Morton  Thiokol, 
Inc.,  Wasatch  Division,  Brigham  City,  Utah,  is 
the  contractor  for  the  Solid  Rocket  Motors.  Each 
Solid  Rocket  Motor  case  is  made  of  1 1  individual 
cylindrical  weld  free  steel  sections  about  12  feet 
in  diameter.  When  assembled,  they  form  a  tube 
almost  116  feet  long.  The  1 1  sections  are  the  for- 
ward dome  section,  six  cylindrical  sections,  the 
aft  External  Tank-attach  ring  section,  two  stif- 
fener  sections,  and  the  aft  dome  section. 

The  1 1  sections  of  the  motor  case  are  joined 
by  tang-and-clevis  joints  held  together  by  177 
steel  pins  around  the  circumference  of  each  joint. 

After  the  sections  have  been  machined  to  fine 
tolerances  and  fitted,  they  are  partly  assembled 
at  the  factory  into  four  casting  segments.  Those 
four  cylindrical  segments  are  the  parts  of  the 
motor  case  into  which  the  propellant  is  poured 
(or  cast).  They  are  shipped  by  rail  in  separate 
pieces  to  Kennedy. 

Joints  assembled  before  the  booster  is  shipped 
are  known  as  factory  joints.  Joints  between  the 
four  casting  segments  are  called  field  joints;  they 
are  connected  at  Kennedy  when  the  booster 
segments  are  stacked  for  final  assembly. 

Orbital  Maneuvering  System 

The  two  engine  pods  on  the  aft  fuselage  of  the 
Orbiter  contain  maneuvering  engines  and  their 
propellant  —  monomethyl  hydrazine  (the  fuel)  and 
nitrogen  tetroxide  (the  oxidizer).  Helium 
pressurizes  the  propellant  tanks,  and  the  fuel  and 
the  oxidizer  ignite  on  contact. 

Forty-four  small  rocket  motors  in  the  Orbiter's 
nose  and  aft  section  maneuvering  system  pods 
allow  adjustments  of  the  vehicle's  attitude  in  pitch, 
yaw,  and  roll  axes.  They  also  may  be  used  to 
make  small  changes  of  velocity  along  one  of  the 
Orbiter's  three  axes. 


Flight  of  a  Shuttle 

Except  for  ascent  and  entry,  all  of  the  Shut- 
tle's typical  seven-day  mission  is  in  orbit.  That 
is  where  the  goals  of  a  given  mission  are  ac- 
complished: scientific  experiments  carried  out; 


satellites  deployed  into  orbit,  retrieved  or 
repaired;  observations  made  of  the  Earth  and  the 
solar  system.  The  Shuttle  makes  one  revolution 
of  the  Earth  approximately  every  90  minutes  dur- 
ing the  satellite  mission. 

When  it  comes  out  of  orbit,  the  Shuttle  is  mov- 
ing at  about  17,500  miles  an  hour.  Reaction 
engines  position  the  Orbiter  nose  forward  again 
for  entry  into  the  atmosphere.  Those  thrusters 
continue  to  control  the  Orbiter's  attitude  until  the 
atmosphere  becomes  dense  enough  for  the 
aerodynamic  surfaces  to  take  effect. 

The  Shuttle  enters  the  ever-thickening  blanket 
of  atmosphere  at  400,000  feet  of  altitude  and  a 
speed  of  more  than  17,000  miles  an  hour  (about 
Mach  25).  The  Orbiter's  nose  is  positioned  40 
degrees  above  its  flight  path.  That  attitude  in- 
creases aerodynamic  drag,  thus  helping  to 
dissipate  the  tremendous  amount  of  energy  that 
the  spacecraft  has  when  it  enters  the  atmosphere. 
Friction  heats  the  surface  of  the  Orbiter,  which 
is  protected  by  thermal  tiles,  and  ionizes  the  sur- 
rounding air,  preventing  radio  communication 
with  Earth  for  the  next  13  minutes. 

The  flight  control  system's  computer  program 
allows  use  of  the  reaction  thrusters  and 
aerodynamic  surfaces  in  combination  to  control 
the  spacecraft.  At  Mach  4.2,  the  rudder  is  ac- 
tivated, and  the  last  reaction  thrusters  are  deac- 
tivated at  Mach  1 .  Thereafter,  the  craft  is  entirely 
maneuvered  like  an  airplane  by  movement  of  the 
aerodynamic  control  surfaces:  elevons,  rudder, 
speed  brake,  and  body  flap. 

In  the  landing  approach,  the  Orbiter  has  no 
propulsion.  It  has  only  its  velocity  and  altitude. 
Its  energy  must  be  carefully  managed  to 
maneuver  the  Shuttle  aerodynamically  to  a  safe 
landing.  Beginning  this  terminal  phase,  the  glide 
slope  is  steep— 19  degrees  — as  the  Orbiter 
descends  toward  the  runway.  Half  a  minute 
before  touchdown  and  two  miles  from  the  run- 
way, the  craft  flares  to  a  shallow,  almost  flat  1 .5 
degree  glide  slope.  Touchdown  occurs  at  225 
miles  per  hour.  On  the  runway,  the  Orbiter  rolls 
to  a  stop,  and  the  mission  is  complete.  ■ 
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Chapter  II 


Events  Leading 
Up  to  the 
Challenger  Mission 


Preparations  for  the  launch  of  mission 
51-L  were  not  unusual,  though  they 
were  complicated  by  changes  in  the 
launch  schedule.  The  sequence  of 
complex,  interrelated  steps  involved  in  produc- 
ing the  detailed  schedule  and  supporting  logistics 
necessary  for  a  successful  mission  always  requires 
intense  effort  and  close  coordination. 

Flight  51-L  of  the  Challenger  was  originally 
scheduled  for  July,  1985,  but  by  the  time  the  crew 
was  assigned  in  January,  1985,  launch  had  been 
postponed  to  late  November  to  accommodate 
changes  in  payloads.  The  launch  was  subsequent- 
ly delayed  further  and  finally  rescheduled  for  late 
January,  1986. 

After  the  series  of  payload  changes,  the 
Challenger  cargo  included  two  satellites  in  the 
cargo  bay  and  equipment  in  the  crew  compart- 
ment for  experiments  that  would  be  carried  out 
during  the  mission.  The  payloads  flown  on  mis- 
sion 51-L  are  listed  in  this  table: 

Mission  51-L  Payloads 

Tracking  and  Data  Relay  Satellite-B 

Spartan-Halley  Satellite 

Comet  Halley  Active  Monitoring  Program 

Fluid  Dynamics  Experiment 

Phase  Partitioning  Experiment 

Teacher  in  Space  Project 

Shuttle  Student  Involvement  Program 

Radiation  Monitoring  Experiment 

The  primary  payloads  were  the  Tracking  and 
Data  Relay  Satellite  (a  NASA  communications 
satellite)  and  the  Spartan  satellite  that  would  be 
deployed  into  orbit  carrying  special  instruments 


for  the  observation  of  Halley's  Comet. 

The  NASA  communications  satellite  was  to 
have  been  placed  in  a  geosynchronous  orbit  with 
the  aid  of  a  booster  called  the  Inertial  Upper 
Stage.  The  satellite  would  have  supported  com- 
munications with  the  Space  Shuttle  and  up  to  23 
other  spacecraft. 

The  Spartan  satellite  was  to  have  been 
deployed  into  low  Earth  orbit  using  the  remote 
manipulator  system.  The  Spartan  instruments 
would  have  watched  Halley's  Comet  when  it  was 
too  close  to  the  Sun  for  other  observatories  to  do 
so.  Subsequently,  the  satellite  would  have  been 
retrieved  and  returned  to  Earth  in  the  Shuttle 
payload  bay. 

Crew  Assignments 

On  January  27,  1985,  one  year  before  launch, 
NASA  announced  the  names  of  the  astronauts 
assigned  to  mission  51-L: 

Commander 

Pilot 

Mission  Specialist 

One 
Mission  Specialist  Judith  A.  Resnik 

Two 
Mission  Specialist 

Three 


Francis  R.  Scobee 
Michael  J.  Smith 
Ellison  S.  Onizuka 


Ronald  E.  McNair 


The  mission  commander,  Francis  R.  (Dick) 
Scobee,  first  flew  on  the  Space  Shuttle  as  the  pilot 
of  mission  41 -C  in  April,  1984.  Mr.  Scobee,  a 
native  of  Auburn,  Washington,  received  his 
bachelor's  degree  in  aerospace  engineering  from 
the  University  of  Arizona.  A  former  Air  Force 
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Space  Shuttle  51 -L  on  Pad  39B  of  Kennedy  Space  Center's  launch  complex. 
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test  pilot  with  7,000  hours  in  45  aircraft  tvpes, 
he  became  an  astronaut  in  1978. 

The  mission  pilot,  Captain  Michael  J.  Smith, 
USN,  was  on  his  first  Shuttle  flight  after  being 
selected  as  an  astronaut  in  1980.  A  native  of 
Beaufort,  North  Carolina,  Captain  Smith,  a  1967 
graduate  of  the  United  States  Naval  Academy, 
received  a  master's  degree  from  the  Naval 
Postgraduate  School.  He  was  a  Navy  test  pilot 
with  extensive  experience  in  a  variety  of  aircraft. 

Mission  specialist  Lieutenant  Colonel  Ellison 
S.  Onizuka,  USAF,  from  Kealakekua,  Kona, 
Hawaii,  received  his  master's  degree  in  aerospace 
engineering  at  the  University  of  Colorado.  A 
flight  test  engineer  in  the  Air  Force,  he  became 


an  astronaut  in  1978  and  flew  on  the  first  military 
mission  (51-C)  in  January,  1985,  aboard  the 
Space  Shuttle  Discovery. 

Mission  specialist  Judith  A.  Resnik,  Ph.D.. 
flew  on  the  first  flight  of  the  Orbiter  Discovery 
on  mission  41-D  in  August,  1984.  Born  in  Akron. 
Ohio,  Dr.  Resnik  received  her  doctorate  in  elec- 
trical engineering  from  the  University  of 
Maryland  in  1976.  After  working  for  several  in- 
dustrial firms,  she  became  an  astronaut  in  1978. 

Mission  specialist  Ronald  E.  McNair,  Ph.D., 
a  native  of  Lake  City,  South  Carolina,  received 
his  doctorate  in  physics  from  the  Massachusetts 
Institute  of  Technology  in  1976.  After  working 
as  a  research  physicist  in  civilian  industry,  he 
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milestones  in  the  months  that  preceded  the  launching  of  the 
Mission  51-L  Shuttle 
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became  an  astronaut  in  1978  and  first  flew  on 
mission  41-B  in  February,  1984,  aboard  the 
Space  Shuttle  Challenger. 

Payload  specialists  are  members  of  a  Space 
Shuttle  crew  who  are  not  career  astronauts.  Two 
such  specialists,  Christa  McAuliffe  and  Gregory 
B.  Jarvis,  were  added  to  the  crew  of  mission  51-L. 

Ms.  McAuliffe  was  born  in  Boston  and  raised 
in  Framingham,  Massachusetts,  where  she 
graduated  from  Framingham  State  College.  After 
teaching  a  variety  of  junior  high  and  high  school 
subjects  in  Maryland  and  New  Hamphire,  she 
was  selected  as  the  Teacher  in  Space.  She  was 
assigned  to  the  51-L  crew  in  July,  1985. 

Mr.  Jarvis  was  a  former  Air  Force  engineer 
who  specialized  in  satellite  design.  He  was  born 
in  Detroit,  Michigan,  and  received  his  master's 
degree  in  electrical  engineering  from  North- 
eastern University  in  Boston.  He  was  assigned 
to  the  51-L  crew  in  October,  1985,  as  a  represent- 
ative of  the  Hughes  Aircraft  Company. 

The  payload  specialists  each  had  respon- 
sibilities for  mission  51-L.  Ms.  McAuliffe  was  to 
conduct  a  series  of  classroom  lessons  from  orbit 
and  conduct  several  basic  classroom  experiments. 
Mr.  Jarvis  was  to  perform  a  series  of  fluid 
dynamics  experiments  that  would  support  satellite 
redesign. 

Preparations  for  Flight 

Planning  for  mission  51-L  began  in  1984,  but 
10  major  change  documents  adding  or  deleting 
payload  items  caused  some  disruption  in  the 
preparation  process.  Because  the  12-  to  18-month 
process  is  a  series  of  repetitive  cycles  that  define 
a  flight  design  in  progressively  more  specific 
detail,  significant  changes  can  require  extensive 
time  and  effort  to  incorporate.  The  closer  to  the 
planned  launch  date  the  changes  occur,  the  more 
difficult  and  disruptive  it  becomes  to  repeat  the 
cycles  necessary  to  complete  a  mission  plan.  (See 
the  Mission  51-L  Milestone  Summary  chart.) 
Although  there  were  several  significant  changes 
to  the  cargo  manifest,  most  occurred  early  enough 
in  the  planning  cycle  to  minimize  their  impact 
on  the  flight  preparation. 

The  cargo  integration  review  is  one  of  the 
crucial  coordination  meetings  in  the  flight 
preparation  process.  At  that  meeting,  re- 
quirements for  all  payloads  are  examined  to  en- 
sure that,  collectively,  they  are  within  the 
capabilities  of  the  vehicle  and  crew. 


For  mission  51-L,  the  cargo  integration  review 
was  rescheduled  six  times,  primarily  because  of 
payload  changes.  All  major  payload  changes  were 
made,  however,  before  the  review  eventually  took 
place  on  June  18,  1985,  seven  months  before  the 
launch.  Until  the  cargo  integration  review  for  a 
mission  is  completed,  the  development  of  the  final 
flight  design  products  cannot  really  get  underway. 
Because  the  mission  51-L  payload  changes  were 
made  before  the  cargo  integration  review, 
however,  changes  to  the  manifest  did  not  seriously 
disrupt  the  preparatibn  cycle. 

Once  the  principal  payload  items  were  deter- 
mined and  the  cargo  integration  review  was  com- 
pleted, the  flight  design  process  became  relatively 
straightforward.  The  flight  design  process  is  the 
central  element  in  flight  preparation.  The  proc- 
ess transforms  the  broad  objectives  of  the  flight 
into  a  detailed  sequence  of  events  from  launch 
to  landing.  For  mission  51-L,  the  objectives  con- 
sisted of  placing  one  satellite  in  orbit,  deploying 
and  retrieving  Spartam,  and  conducting  the  six 
experiments.  From  that  base,  the  flight  design 
process  produced  a  detailed  schedule  of  events, 
trajectory  data,  requirements  for  consumable 
items,  communications  requirements  and  the 
necessary  computer  programing  for  the  Orbiter, 
the  Mission  Control  Center,  and  the  Shuttle 
simulator  used  to  train  the  crew  for  this  particular 
mission. 

The  launch  minus  five  months  Flight  Plan- 
ning and  Stowage  Review  was  conducted  on 
August  20,  1985,  to  address  any  unresolved  issues 
and  any  changes  to  the  plan  that  had  developed 
to  that  point.  Ideally,  the  mission  events  are  firm- 
ly determined  before  the  review  takes  place.  For 
mission  51-L,  however,  Mr.  Jarvis  was  not  added 
to  the  crew  until  October  25,  1985,  and  his  ac- 
tivities could  not  be  incorporated  into  mission 
planning  until  that  time.  The  crew  activity  plan, 
the  formal  flight  requirements  and  the  flight 
design  status  were  reviewed  as  well  as  the  cur- 
rent status  of  the  engineering  integration,  the 
photo  and  TV  requirements,  and  crew  compart- 
ment stowage.  The  Flight  Planning  and  Stowage 
Review  did  identify  the  need  for  further  con- 
sideration of  the  launch  window  and  of  the  then 
undefined  requirements  for  the  Teacher-in-Space 
program. 

There  were  changes  to  middeck  payloads, 
resulting  from  the  addition  of  Mr.  Jarvis,  that 
occurred  less  than  three  months  before  launch. 
The  most  negative  result  of  the  changes  was  a 
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delay  in  publishing  the  crew  activity  plan.  The 
crew  activity  plan  specifies  the  in-flight  schedule 
for  all  crew  members,  which  in  turn  affects  other 
aspects  of  flight  preparation.  Because  the  NASA 
communications  satellite  training  requirements 
were  quite  similar  to  those  for  a  previous  flight, 
the  crew  training  began  using  that  existing  crew 
activity  plan  and  associated  checklists.  Con- 
siderable time  was  saved  as  a  result.  The  re- 
quirements unique  to  Spartan  did  not  involve  ma- 
jor departures  from  the  standard  satellite  deploy- 
ment and  rendezvous  techniques  that  had  been 
developed  on  mission  51-G,  the  experiment 
packages  did  not  require  any  new  Orbiter  pro- 
cedures, and  the  ascent  and  entry  techniques  were 


standard.  Thus,  mission  51-L  did  not  involve 
radical  departures  from  previous  flight  patterns. 
The  crew  began  training  37  weeks  before 
launch.  Preparation  in  the  Shuttle  Mission 
Simulator,  a  fully  instrumented  mock-up  of  the 
Shuttle  interior,  began  at  launch  minus  36  weeks. 
Integrated  training  in  the  simulator,  which  allows 
the  crew  to  train  with  the  flight  controllers  who 
will  be  controlling  the  flight  in  both  the  Mission 
Control  Center  and  remote  centers,  began  at 
launch  minus  nine  weeks.  For  the  crew,  Shuttle 
simulator  training  included  preparation  for  the 
use  of  the  robot  arm,  a  rendezvous  in  space,  In- 
ertial  Upper  Stage  deployment,  ascent  and  en- 
try procedures,  and  a  variety  of  other  activities 


Crew  Workload  Comparison 
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Graph  compares  training  workloads  of  crews  for  six  Shuttle 
missions  in  the  nine  weeks  that  preceded  the  launching  of 
the  space  flights 
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that  must  be  practiced  repeatedly  if  a  Shuttle  mis- 
sion is  to  be  carried  out  successfully. 

All  NASA  crew  members  exceeded  the  number 
of  training  hours  required  and  were  certified  pro- 
ficient in  all  mission  tasks.  The  two  payload 
specialists  also  fulfilled  their  training  re- 
quirements. All  mission  51-L  astronauts  and 
flight  controllers  were  certified  ready  for  flight. 

From  a  flight  design  process  point  of  view,  mis- 
sion 51-L  was  a  fairly  typical  mission.  The  most 
noticeable  effect  of  the  delays  in  the  production 
process  was  a  delay  in  the  start  of  Shuttle  Mis- 
sion Simulator  training  specific  to  the  flight.  That 
training  began  at  launch  minus  nine  weeks  for 
the  crew  of  51-L,  two  weeks  later  than  the  original 
schedule  required. 

Compressed  training  time  was  becoming  a  con- 
cern in  late  1985.  The  crew  of  mission  51-L  train- 
ed for  an  average  of  48.7  hours  per  week  during 
those  nine  weeks  before  launch,  with  peaks 
reaching  65  to  70  hours  per  week.  Much  more 
compression  in  their  training  schedule  would  not 
have  been  possible.  (See  the  Crew  Workload 
Comparisons  graph.) 

Launch  date  delays  for  mission  61-C  also 
became  a  scheduling  factor  for  the  integrated 
simulations  for  mission  51-L.  Originally  sched- 
uled for  the  third  week  in  December,  the  61-C 
launch  was  delayed  until  January  12,  1986.  Dur- 
ing the  last  six  weeks  before  the  Challenger 
launch,  the  51-L  schedule  was  changed  several 
times  as  a  result  of  launch  delays  of  61-C.  The 
final  impact  on  the  Challenger  crew  training  was 
reduced  spacing  between  the  ascent  and  entry 
simulations  during  the  last  two  weeks  before 
launch,  but  no  training  time  was  lost. 


Flight  Readiness  Review 

The  Level  I  Flight  Readiness  Review  for  mis- 
sion 51-L  took  place  on  January  15,  1986.  The 
Flight  Readiness  Review  should  address  all 
aspects  of  flight  preparation  about  which  any 
questions  have  arisen.  In  addition,  attendees  con- 
firm that  all  equipment  and  operational  plans 
have  been  certified  ready  by  the  responsible 
manager  within  NASA.  Solid  Rocket  Booster 
joints  were  not  discussed  during  the  review  on 
January  15. 

The  period  during  the  day  when  a  particular 


flight  can  be  launched  is  determined  by  the  re- 
quirements of  the  Orbiter  and  the  payloads.  The 
launch  period  for  mission  51-L  was  limited  in 
order  to  provide  the  best  lighting  conditions  for 
Spartan's  observations  of  Halley's  Comet.  The 
resulting  "launch  window"  was  a  topic  of  some 
discussion  at  the  Flight  Readiness  Review.  The 
Challenger  launch  originally  had  been  scheduled 
for  a  morning  lift  off.  When  Spartan  was  added 
to  the  mission,  the  launch  window  was  changed 
to  the  afternoon.  This  change  would  have  re- 
quired a  landing  at  night  if  a  transatlantic  abort 
landing  had  become  necessary.  Because  the  alter- 
nate transatlantic  site,  Casablanca,  was  not 
equipped  for  a  night  landing,  the  afternoon 
launch  eliminated  that  back-up  site.  As  January 
drew  to  a  close,  however,  the  conditions  for  op- 
timum telescopic  viewing  of  the  comet  could  not 
be  met.  The  launch  window  was  shifted  back  to 
the  morning  hours  so  that  the  transatlantic  abort 
site  would  be  in  daylight  and  a  back-up  site 
(Casablanca)  would  be  available. 

The  results  of  the  flight  design  process  were 
summarized  at  the  Flight  Readiness  Review.  The 
predicted  ascent  performance,  including  expected 
trajectory,  main  engine  throttling  profile,  ex- 
pected dynamic  pressure  and  the  amount  of  pro- 
pellant  reserve  expected  at  main  engine  cutoff, 
were  presented  and  discussed.  The  expected  land- 
ing parameters,  weight  and  center  of  gravity 
figures  were  also  presented  for  a  variety  of  con- 
tingencies. It  should  be  noted  that  a  waiver  was 
required  because  the  weight  of  the  Orbiter  ex- 
ceeded the  allowable  limits  for  an  abort  landing. 
The  flight  design  data  presented  at  the  Flight 
Readiness  Review  are  available  in  the  Appendix 
in  the  NASA  Mission  Planning  and  Operations 
Team  Report.  No  outstanding  concerns  were 
identified  in  the  discussion  of  flight  design. 

The  detailed  flight  plan  and  schedule  of  crew 
activities  also  were  presented  at  the  Flight 
Readiness  Review.  The  Challenger  was  to  circle 
the  Earth  for  six  days  at  an  orbital  altitude  of  ap- 
proximately 153  nautical  miles,  landing  early  on 
the  seventh  day  at  Kennedy  in  Florida. 

The  major  activities  were  to  include  deploy- 
ment of  the  tracking  and  data  relay  satellite  10 
hours  after  launch,  deployment  of  the  Spartan 
satellite  on  the  third  day  of  the  flight  and  subse- 
quent retrieval  of  the  Spartan  two  days  later.  A 
summary  of  the  planned  activities  is  provided  in 
the  table  that  follows. 
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Mission  51-L  Orbital  Activity  Schedule 
Day  One 


After  arriving  in  orbit,  the  crew  had  two  periods  of  scheduled  high  activity.  First, 
they  were  to  check  the  readiness  of  the  NASA  satellite  prior  to  planned  deploy- 
ment. After  a  lunch  break,  they  were  to  deploy  the  satellite  and  Inertial  Upper 
Stage  and  to  perform  a  series  of  separation  maneuvers.  The  first  sleep  period  was 
scheduled  to  be  eight  hours  long  starting  about  18  hours  after  crew  wake-up  on 
launch  morning. 


Day  Two  The  Comet  Halley  Active  Monitoring  Program  experiment  was  scheduled  to  begin 

on  the  second  day.  Also  scheduled  were  the  initial  teacher-in-space  video  taping 
and  a  firing  of  the  orbital  maneuvering  engines  to  place  the  Orbiter  at  the  152-mile 
orbital  altitude  from  which  the  Spartan  would  be  deployed. 

Day  Three  The  third  day  was  to  start  with  the  crew  programing  the  Spartan  satellite  with 

data  sent  from  Johnson.  The  satellite  was  to  be  deployed  using  the  remote 
manipulator  system  (the  robot  arm),  and  then  the  Orbiter  would  be  maneuvered 
to  produce,  by  day  four,  a  90-mile  separation  from  Spartan. 

Day  Four  The  Orbiter  was  to  begin  closing  on  Spartan  while  Jarvis  continued  the  fluid 

dynamics  experiments  started  on  day  two  and  day  three.  In  addition,  two  lessons 
telecast  live  were  to  be  conducted  by  Ms.  McAuliffe. 


Day  Five 


After  rendezvous  with  Spartan,  the  crew  was  to  use  the  robot  arm  to  capture  the 
satellite  and  re-stow  it  in  the  payload  bay. 


Day  Six 


Entry  preparations  were  to  dominate  the  last  full  day  in  space:  flight  control  system 
checks,  test  firing  of  maneuvering  jets  needed  for  entry,  and  cabin  stowage.  A 
crew  news  conference  also  was  scheduled  following  the  lunch  period,  if  requested 
by  the  NASA  Public  Affairs  Office. 


Day  Seven  The  seventh  day  would  have  been  spent  preparing  the  Space  Shuttle  for  deorbit 

and  entry  into  the  atmosphere.  The  Challenger  was  scheduled  to  land  at  Ken- 
nedy 144  hours  and  34  minutes  after  launch. 
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Launch  Delays 


The  launch  of  mission  51-L  was  postponed 
three  times  and  scrubbed  once  from  the  planned 
date  of  January  22,  1986.  The  first  postponement 
was  announced  on  December  23,  1985.  That 
change  established  the  launch  date  as  January  23, 
1986,  in  order  to  accommodate  the  final  in- 
tegrated simulation  schedule  that  resulted  from 
the  slip  in  the  launch  date  of  mission  61-C. 

On  January  22,  1986,  the  Program  Re- 
quirements Change  Board  first  slipped  the  launch 
from  January  23  to  January  25.  That  date  subse- 
quently was  changed  to  January  26,  1986, 
primarily  because  of  Kennedy  work  requirements 
produced  by  the  late  launch  of  mission  61-C. 

The  third  postponement  of  the  launch  date  oc- 
curred during  an  evening  management  con- 
ference on  January  25,  1986,  to  review  the 
weather  forecast  for  the  Kennedy  area.  Because 
the  forecast  was  for  unacceptable  weather 
throughout  the  launch  window  on  January  26, 
early  countdown  activities  that  had  already 
started  were  terminated. 

The  launch  attempt  of  January  27  began  the 
day  before  as  the  complex  sequence  of  events 
leading  to  lift  off  commenced.  Fueling  of  the  Ex- 
ternal Tank  began  at  12:30  a.m.  Eastern  Stand- 
ard Time.  The  crew  was  awakened  at  05:07  a.m., 
and  events  proceeded  normally  with  the  crew 
strapped  into  the  Shuttle  at  07:56  a.m.  At  09:10, 
however,  the  countdown  was  halted  when  the 
ground  crew  reported  a  problem  with  an  exterior 
hatch  handle.  By  the  time  the  hatch  handle  prob- 
lem was  solved  at  10:30  a.m.,  winds  at  the  Ken- 
nedy runway  designated  for  a  return-to-launch- 
site  abort  had  increased  and  exceeded  the 
allowable  velocity  for  crosswinds.  The  launch  at- 
tempt for  January  27  was  canceled  at  12:35  p.m. 
Eastern  Standard  Time;  the  Challenger  count- 
down was  rescheduled  for  January  28. 

The  weather  was  forecast  to  be  clear  and  very 
cold,  with  temperatures  dropping  into  the  low 
twenties  overnight.  The  management  team 
directed  engineers  to  assess  the  possible  effects  of 
temperature  on  the  launch.  No  critical  issues  were 
identified  to  management  officials,  and  while 
evaluation  continued,  it  was  decided  to  proceed 
with  the  countdown  and  the  fueling  of  the  Ex- 
ternal Tank. 

Ice  had  accumulated  in  the  launch  pad  area 


during  the  night  and  it  caused  considerable  con- 
cern for  the  launch  team.  In  reaction,  the  ice  in- 
spection team  was  sent  to  the  launch  pad  at  01 :35 
a.m.,  January  28,  and  returned  to  the  Launch 
Control  Center  at  03:00  a.m.  After  a  meeting  to 
consider  the  team's  report,  the  Space  Shuttle  pro- 
gram manager  decided  to  continue  the  count- 
down. Another  ice  inspection  was  scheduled  at 
launch  minus  three  hours. 

Also,  during  the  night,  prior  to  fueling,  a  prob- 
lem developed  with  a  fire  detector  in  the  ground 
liquid  hydrogen  storage  tank.  Though  it  was 
ultimately  tracked  to  a  hardware  fault  and 
repaired,  fueling  was  delayed  by  two  and  one- 
half  hours.  By  continuing  past  a  planned  hold  at 
launch  minus  three  hours,  however,  the  launch 
delay  was  reduced  to  one  hour.  Crew  wake-up 
was  rescheduled  for  06:18  a.m.,  January  28,  but 
by  that  time  the  crew  was  already  up. 

Because  of  forecast  rain  and  low  ceilings  at 
Casablanca,  the  alternate  abort  site,  that  site  was 
declared  a  "no-go"  at  07:30  a.m.  The  change  had 
no  mission  impact,  however,  because  the  weather 
at  the  primary  transatlantic  abort  landing  site  at 
Dakar,  Senegal,  was  acceptable.  The  abort-once- 
around  site  was  Edwards  Air  Force  Base, 
California. 

With  an  extra  hour,  the  crew  had  more  than 
sufficient  time  to  eat  breakfast,  get  a  weather 
briefing  and  put  on  flight  gear.  At  the  weather 
briefing,  the  temperature  and  ice  on  the  pad  were 
discussed,  but  neither  then  nor  in  earlier  weather 
discussions  was  the  crew  told  of  any  concern 
about  the  effects  of  low  temperature  on  the  Shuttle 
System.  The  seven  crew  members  left  the  crew 
quarters  and  rode  the  astronaut  van  to  launch  pad 
B,  arriving  at  08:03.  They  were  in  their  seats  in 
the  Challenger  at  08:36  a.m. 

At  08:44  a.m.  the  ice  team  completed  its  sec- 
ond inspection.  After  hearing  the  team's  report, 
the  program  manager  decided  to  allow  additional 
time  for  ice  to  melt  on  the  pad.  He  also  decided 
to  send  the  ice  team  to  perform  one  final  ice 
assessment  at  launch  minus  20  minutes.  When 
the  count  was  resumed,  launch  had  been  delayed 
a  second  hour  beyond  the  original  lift  off  time  of 
09:38  a.m.,  Eastern  Standard  Time. 

At  11:15  the  ice  inspection  was  completed,  and 
during  the  hold  at  launch  minus  nine  minutes, 
the  mission  51-L  crew  and  all  members  of  the 
launch  team  gave  their  "go"  for  launch.  The  final 
flight  of  the  Challenger  began  at  11:38:00.010 
a.m.,  Eastern  Standard  Time,  January  28,  1986. 
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The  Flight  of  the  Challenger 


The  events  that  followed  lift  off  were  brief: 

Launch  Time       Event 

-6.6  sec.  Space  Shuttle  engines  ignition 

0  sec.  Solid  Rocket  Booster  ignition 

+  7  sec.  "Roll  program."  (Challenger) 

"Roger,  roll,  Challenger." 

(Houston) 
+  24  sec.  Main  engines  throttled  down  to 

94% 
+  42  sec.  Main  engines  throttled  down  to 

65% 
+  59  sec.  Main  engines  throttled  up  to 

104% 
+  65  sec.  "Challenger,  go  at  throttle  up." 

(Houston)  "Roger.  Go  at  throttle 

up."  (Challenger) 
+  73  sec.  Loss  of  signal  from  Challenger 


From  lift  off  until  the  signal  from  the  Shuttle 
was  lost,  no  flight  controller  observed  any  indica- 
tion of  a  problem.  The  Shuttle's  main  engines 
throttled  down  to  limit  the  maximum  dynamic 
pressure,  then  throttled  up  to  full  thrust  as  ex- 


pected. Voice  communications  with  the  crew 
were  normal.  The  crew  called  to  indicate  the 
Shuttle  had  begun  its  roll  to  head  due  east  and 
to  establish  communication  after  launch.  Fifty- 
seven  seconds  later,  Mission  Control  informed 
the  crew  that  the  engines  had  successfully  throt- 
tled up  and  all  other  systems  were  satisfactory. 
The  commander's  acknowledgment  of  this  call 
was  the  last  voice  communication  from  the 
Challenger. 

There  were  no  alarms  sounded  in  the  cockpit. 
The  crew  apparently  had  no  indication  of  a  prob- 
lem before  the  rapid  break-up  of  the  Space  Shuttle 
system.  The  first  evidence  of  an  accident  came 
from  live  video  coverage.  Radar  then  began  to 
track  multiple  objects.  The  flight  dynamics  of- 
ficer in  Houston  confirmed  to  the  flight  director 
that  "RSO  [range  safety  officer]  reports  vehicle 
exploded,"  and  30  seconds  later  he  added  that  the 
range  safety  officer  had  sent  the  destruct  signal 
to  the  Solid  Rocket  Boosters. 

During  the  period  of  the  flight  when  the  Solid 
Rocket  Boosters  are  thrusting,  there  are  no  sur- 
vivable  abort  options.  There  was  nothing  that 
either  the  crew  or  the  ground  controllers  could 
have  done  to  avert  the  catastrophe.  ■ 
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Chapter  III 


The  Accident 


Flight  of  the  Space  Shuttle  Challenger  on 
Mission  51-L  began  at  11:38  a.m. 
Eastern  Standard  Time  on  January  28, 
1986.  It  ended  73  seconds  later  in 
an  explosive  burn  of  hydrogen  and  oxygen  pro- 
pellants  that  destroyed  the  External  Tank  and  ex- 
posed the  Orbiter  to  severe  aerodynamic  loads 
that  caused  complete  structural  breakup.  All 
seven  crew  members  perished.  The  two  Solid 
Rocket  Boosters  flew  out  of  the  fireball  and  were 
destroyed  by  the  Air  Force  range  safety  officer 
110  seconds  after  launch. 

The  ambient  air  temperature  at  launch  was  36 
degrees  Fahrenheit  measured  at  ground  level  ap- 
proximately 1,000  feet  from  the  51-L  mission 
launch  pad  39B.  This  temperature  was  15  degrees 
colder  than  that  of  any  previous  launch. 

The  following  description  of  the  flight  events 
is  based  on  visual  examination  and  image 
enhancement  of  film  from  NASA  operated 
cameras  and  telemetry  data  transmitted  from  the 
Space  Shuttle  to  ground  stations.  The  last 
telemetry  data  from  the  Challenger  was  received 
73.618  seconds  after  launch. 

At  6.6  seconds  before  launch,  the  Challenger's 
liquid  fueled  main  engines  were  ignited  in  se- 
quence and  run  up  to  full  thrust  while  the  entire 
Shuttle  structure  was  bolted  to  the  launch  pad. 
Thrust  of  the  main  engines  bends  the  Shuttle 
assembly  forward  from  the  bolts  anchoring  it  to 
the  pad.  When  the  Shuttle  assembly  springs  back 
to  the  vertical,  the  Solid  Rocket  Boosters'  restrain- 
ing bolts  are  explosively  released.  During  this  pre- 
release "twang"  motion,  structural  loads  are  stored 
in  the  assembled  structure.  These  loads  are  re- 
leased during  the  first  few  seconds  of  flight  in  a 
structural  vibration  mode  at  a  frequency  of  about 


3  cycles  per  second.  The  maximum  structural 
loads  on  the  aft  field  joints  of  the  Solid  Rocket 
Boosters  occur  during  the  "twang,"  exceeding 
even  those  of  the  maximum  dynamic  pressure 
period  experienced  later  in  flight. 

Just  after  liftoff  at  .678  seconds  into  the  flight, 
photographic  data  show  a  strong  puff  of  gray 
smoke  was  spurting  from  the  vicinity  of  the  aft 
field  joint  on  the  right  Solid  Rocket  Booster.  The 
two  pad  39B  cameras  that  would  have  recorded 
the  precise  location  of  the  puff  were  inoperative. 
Computer  graphic  analysis  of  film  from  other 
cameras  indicated  the  initial  smoke  came  from 
the  270  to  310-degree  sector  of  the  circumference 
of  the  aft  field  joint  of  the  right  Solid  Rocket 
Booster.  This  area  of  the  solid  booster  faces  the 
External  Tank.  The  vaporized  material  stream- 
ing from  the  joint  indicated  there  was  not  com- 
plete sealing  action  within  the  joint. 

Eight  more  distinctive  puffs  of  increasingly 
blacker  smoke  were  recorded  between  .836  and 
2.500  seconds.  The  smoke  appeared  to  puff  up- 
wards from  the  joint.  While  each  smoke  puff  was 
being  left  behind  by  the  upward  flight  of  the  Shut- 
tle, the  next  fresh  puff  could  be  seen  near  the  level 
of  the  joint.  The  multiple  smoke  puffs  in  this  se- 
quence occurred  at  about  four  times  per  second, 
approximating  the  frequency  of  the  structural 
load  dynamics  and  resultant  joint  flexing.  Com- 
puter graphics  applied  to  NASA  photos  from  a 
variety  of  cameras  in  this  sequence  again  placed 
the  smoke  puffs'  origin  in  the  270-to  310-degree 
sector  of  the  original  smoke  spurt. 

As  the  Shuttle  increased  its  upward  velocity, 
it  flew  past  the  emerging  and  expanding  smoke 
puffs.  The  last  smoke  was  seen  above  the  field 
joint  at  2.733  seconds.  At  3.375  seconds  the  last 
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smoke  was  visible  below  the  Solid  Rocket 
Boosters  and  became  indiscernible  as  it  mixed 
with  rocket  plumes  and  surrounding  atmosphere. 

The  black  color  and  dense  composition  of  the 
smoke  puffs  suggest  that  the  grease,  joint  insula- 
tion and  rubber  O-rings  in  the  joint  seal  were  be- 
ing burned  and  eroded  by  the  hot  propellant 
gases. 

Launch  sequence  films  from  previous  missions 
were  examined  in  detail  to  determine  if  there  were 
any  prior  indications  of  smoke  of  the  color  and 
composition  that  appeared  during  the  first  few- 
seconds  of  the  51-L  mission.  None  were  found. 
Other  vapors  in  this  area  were  determined  to  be 
melting  frost  from  the  bottom  of  the  External 
Tank  or  steam  from  the  rocket  exhaust  in  the 
pad's  sound  suppression  water  trays. 

Shuttle  main  engines  were  throttled  up  to  104 
percent  of  their  rated  thrust  level,  the  Challenger 
executed  a  programmed  roll  maneuver  and  the 
engines  were  throttled  back  to  94  percent. 

At  approximately  37  seconds,  Challenger  en- 
countered the  first  of  several  high-altitude  wind 
shear  conditions,  which  lasted  until  about  64 
seconds.  The  wind  shear  created  forces  on  the 
vehicle  with  relatively  large  fluctuations.  These 
were  immediately  sensed  and  countered  by  the 
guidance,  navigation  and  control  system. 
Although  flight  51-L  loads  exceeded  prior  ex- 
perience in  both  yaw  and  pitch  planes  at  certain 
instants,  the  maxima  had  been  encountered  on 
previous  flights  and  were  within  design  limits. 

The  steering  system  (thrust  vector  control)  of 
the  Solid  Rocket  Booster  responded  to  all  com- 
mands and  wind  shear  effects.  The  wind  shear 
caused  the  steering  system  to  be  more  active  than 
on  any  previous  flight. 

At  45  seconds  into  the  flight,  three  bright 
flashes  appeared  downstream  of  the  Challenger's 
right  wing.  Each  flash  lasted  less  than  one- 
thirtieth  of  a  second.  Similar  flashes  have  been 
seen  on  other  flights.  Another  appearance  of  a 
separate  bright  spot  was  diagnosed  by  film 
analysis  to  be  a  reflection  of  main  engine  exhaust 
on  the  Orbital  Maneuvering  System  pods  located 
at  the  upper  rear  section  of  the  Orbiter.  The 
flashes  were  unrelated  to  the  later  appearance  of 
the  flame  plume  from  the  right  Solid  Rocket 
Booster. 

Both  the  Shuttle  main  engines  and  the  solid 
rockets  operated  at  reduced  thrust  approaching 
and    passing    through    the    area    of   maximum 


dynamic  pressure  of  720  pounds  per  square  foot. 
Main  engines  had  been  throttled  up  to  104  per- 
cent thrust  and  the  Solid  Rocket  Boosters  were 
increasing  their  thrust  when  the  first  flickering 
flame  appeared  on  the  right  Solid  Rocket  Booster 
in  the  area  of  the  aft  field  joint.  This  first  very 
small  flame  was  detected  on  image  enhanced  film 
at  58.788  seconds  into  the  flight.  It  appeared  to 
originate  at  about  305  degrees  around  the  booster 
circumference  at  or  near  the  aft  field  joint. 

One  film  frame  later  from  the  same  camera, 
the  flame  was  visible  without  image  enhance- 
ment. It  grew  into  a  continuous,  well-defined 
plume  at  59.262  seconds.  At  about  the  same  time 
(60  seconds),  telemetry  showed  a  pressure  dif- 
ferential between  the  chamber  pressures  in  the 
right  and  left  boosters.  The  right  booster  chamber 
pressure  was  lower,  confirming  the  growing  leak 
in  the  area  of  the  field  joint. 

As  the  flame  plume  increased  in  size,  it  was 
deflected  rearward  by  the  aerodynamic  slipstream 
and  circumferentially  by  the  protruding  structure 
of  the  upper  ring  attaching  the  booster  to  the  Ex- 
ternal Tank.  These  deflections  directed  the  flame 
plume  onto  the  surface  of  the  External  Tank.  This 
sequence  of  flame  spreading  is  confirmed  by 
analysis  of  the  recovered  wreckage.  The  grow- 
ing flame  also  impinged  on  the  strut  attaching 
the  Solid  Rocket  Booster  to  the  External  Tank. 

At  about  62  seconds  into  the  flight,  the  con- 
trol system  began  to  react  to  counter  the  forces 
caused  by  the  plume  and  its  effects.  The  left  Solid 
Rocket  Booster  thrust  vector  control  moved  to 
counter  the  yaw  caused  by  reduced  thrust  from 
the  leaking  right  Solid  Rocket  Booster.  During 
the  next  nine  seconds,  Space  Shuttle  control 
systems  worked  to  correct  anomalies  in  pitch  and 
yaw  rates. 

The  first  visual  indication  that  swirling  flame 
from  the  right  Solid  Rocket  Booster  breached  the 
External  Tank  was  at  64.660  seconds  when  there 
was  an  abrupt  change  in  the  shape  and  color  of 
the  plume.  This  indicated  that  it  was  mixing  with 
leaking  hydrogen  from  the  External  Tank.  Tele- 
metered changes  in  the  hydrogen  tank  pressuriza- 
tion  confirmed  the  leak.  Within  45  milliseconds 
of  the  breach  of  the  External  Tank,  a  bright  sus- 
tained glow  developed  on  the  black-tiled  under- 
side of  the  Challenger  between  it  and  the  Exter- 
nal Tank. 

Beginning  at  about  72  seconds,  a  series  of 
events  occurred  extremely  rapidly  that  terminated 
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the  flight.  Telemetered  data  indicate  a  wide  varie- 
ty of  flight  system  actions  that  support  the  visual 
evidence  of  the  photos  as  the  Shuttle  struggled 
futilely  against  the  forces  that  were  destroying  it. 

At  about  72.20  seconds  the  lower  strut  linking 
the  Solid  Rocket  Booster  and  the  External  Tank 
was  severed  or  pulled  away  from  the  weakened 
hydrogen  tank  permitting  the  right  Solid  Rocket 
Booster  to  rotate  around  the  upper  attachment 
strut.  This  rotation  is  indicated  by  divergent  yaw 
and  pitch  rates  between  the  left  and  right  Solid 
Rocket  Boosters. 

At  73.124  seconds,  a  circumferential  white 
vapor  pattern  was  observed  blooming  from  the 
side  of  the  External  Tank  bottom  dome.  This  was 
the  beginning  of  the  structural  failure  of  the 
hydrogen  tank  that  culminated  in  the  entire  aft 
dome  dropping  away.  This  released  massive 
amounts  of  liquid  hydrogen  from  the  tank  and 
created  a  sudden  forward  thrust  of  about  2.8 
million  pounds,  pushing  the  hydrogen  tank  up- 
ward into  the  intertank  structure.  At  about  the 
same  time,  the  rotating  right  Solid  Rocket  Booster 
impacted  the  intertank  structure  and  the  lower 
part  of  the  liquid  oxygen  tank.  These  structures 


failed  at  73. 137  seconds  as  evidenced  by  the  white 
vapors  appearing  in  the  intertank  region. 

Within  milliseconds  there  was  massive,  almost 
explosive,  burning  of  the  hydrogen  streaming 
from  the  failed  tank  bottom  and  the  liquid  oxy- 
gen breach  in  the  area  of  the  intertank. 

At  this  point  in  its  trajectory,  while  traveling 
at  a  Mach  number  of  1 .92  at  an  altitude  of  46,000 
feet,  the  Challenger  was  totally  enveloped  in  the 
explosive  burn.  The  Challenger's  reaction  con- 
trol system  ruptured  and  a  hypergolic  burn  of  its 
propellants  occurred  as  it  exited  the  oxygen- 
hydrogen  flames.  The  reddish  brown  colors  of  the 
hypergolic  fuel  burn  are  visible  on  the  edge  of  the 
main  fireball.  The  Orbiter,  under  severe 
aerodynamic  loads,  broke  into  several  large  sec- 
tions which  emerged  from  the  fireball.  Separate 
sections  that  can  be  identified  on  film  include  the 
main  engine/tail  section  with  the  engines  still 
burning,  one  wing  of  the  Orbiter,  and  the  for- 
ward fuselage  trailing  a  mass  of  umbilical  lines 
pulled  loose  from  the  payload  bay. 

Evidence  in  the  recovered  wreckage  from  the 
51-L  mission  hardware  supports  this  final  se- 
quence of  events.  ■ 
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Immediately  after  solid  rocket 
motor  ignition,  dark  smoke 
(arrows)  swirled  out  between 
the  right  hand  booster  and 
the  External  Tank.  The 
smoke's  origin,  behavior  and 
duration  was  approximated 
by  visual  analysis  and  com- 
puter enhancement  of  film 
from  five  camera  locations. 
Consensus:  smoke  was  first 
discernible  at  .678  seconds 
Mission  Elapsed  Time  in  the 
vicinity  of  the  right  booster's 
aft  field  joint. 
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Multiple  smoke  puffs  are  visible  in  the  photo  above 
(arrows).  They  began  at  .836  seconds  and  continued 
through  2.500  seconds,  occurring  about  4  times  a 
second.  Upward  motion  of  the  vehicle  caused  the 
smoke  to  drift  downward  and  blur  into  a  single  cloud 
Smoke  source  is  shown  in  the  computer  generated 
drawing  (far  right). 
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At  58.788  seconds,  the  first 
flicker  of  flame  appeared.  Barely 
visible  above,  it  grew  into  a 
large  plume  and  began  to  im- 
pinge on  the  External  Tank  at 
about  60  seconds.  Flame  is  pin- 
pointed in  the  computer  drawing 
between  the  right  booster  and 
the  tank,  as  in  the  case  of  earlier 
smoke  puffs.  At  far  right  (arrow), 
vapor  is  seen  escaping  from  the 
apparently  breached  External 
Tank. 
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Camera  views  indicate  the  beginning  of  rupture  of 
the  liquid  hydrogen  and  liquid  oxygen  tanks  within 
the  External  Tank.  A  small  flash  (arrows  above) 
intensified  rapidly,  then  diminished.  A  second  flash, 


attributed  to  rupture  of  the  liquid  oxygen  tank, 
occurred  above  the  booster/tank  forward  attachment 
(below  left)  and  grew  in  milliseconds  to  the  maximum 
size  indicated  in  the  computer  drawing. 


Structural  breakup  of  the  vehicle  began  at 
approximately  73  seconds.  Fire  spread  very 
rapidly.  Above,  a  bright  flash  (arrow)  is  evi- 
dent near  the  nose  of  the  Orbiter,  suggesting 
spillage  and  ignition  of  the  spacecraft's  re- 
action control  system  propellants.  At  left,  the 
two  Solid  Rocket  Boosters  thrust  away  from 
the  fire,  crisscrossing  to  form  a  "V."  The  right 
booster — identifiable  by  its  failure  plume — 
now  to  the  left  of  its  counterpart.  At  right,  the 
boosters  diverge  farther;  the  External  Tank 
wreckage  is  obscured  by  smoke  and  vapor. 
The  Orbiter  engines  still  firing,  is  visible  at 
bottom  center. 
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At  about  76  seconds,  unidentifiable  fragments  of  the  Shut- 
tle vehicle  can  be  seen  tumbling  against  a  background  of 
fire,  smoke  and  vaporized  propellants  from  the  External 
Tank  (left)  In  the  photo  at  right,  the  left  booster  (far  right) 


soars  away,  still  thrusting.  The  reddish-brown  cloud  envel- 
ops the  disintegrating  Orbiter  The  color  is  characteristic 
of  the  nitrogen  tetroxide  oxidizer  in  the  Orbiter  Reaction 
Control  System  propellant 
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Hurtling  out  of  the  fireball  at 
78  seconds  (left)  are  the 
Orbiter's  left  wing  (top  arrow), 
the  main  engines  (center 
arrow)  and  the  forward  fuse- 
lage (bottom  arrow).  In  the 
photo  below,  it  plummets 
Earthward,  trailed  by  smok- 
ing fragments  of  Challenger. 


At  11  44  a  m.  Eastern  Standard  Time,  a  GOES  environment- 
monitoring  satellite  operated  by  the  National  Oceanic  and 
Atmospheric  Administration  acquired  this  image  of  the 
smoke  and  vapor  cloud  from  the  51-L  accident  The  coast 
of  Florida  is  outlined  in  red 


STS  51-L  Sequence  of  Major  Events 


Mission  Time 
(GMT.  in  hr.min.sec) 


Event 


Elapsed 

Time  (sees.) 

Source 

-6.566 

GPC 

-6.446 

GPC 

-6.326 

GPC 

0.000 

GPC 

0.008 

E8  Camera 

0.250 

E9  Camera 

0.678 

E60  Camera 

0.836 

E63  Camera 

2.733 

CZR-1  Camera 

3.375 

E60  Camera 

4.339 

E41M2076D 

5.674 

B47P2302C 

7.724 

V90R5301C 

19.859 

E41M2076D 

21.124 

V90R5301C 

35.379 

E41M2076D 

36.990 

V95H352nC 

51.860 

E41M2076D 

58.788 

E207  Camera 

59.000 

BET 

16:37:53.444     ME  -  3  Ignition  Command 
37:53.564     ME  -  2  Ignition  Command 
37:53.684     ME  -  1  Ignition  Command 
38:00.010     SRM  Ignition  Command  (T  =  0) 
38:00.018     Holddown  Post  2  PIC  firing 
38:00.260     First  Continuous  Vertical  Motion 
38:00.688     Confirmed  smoke  above  field  joint  on 

RH  SRM 
38:00.846     Eight  puffs  of  smoke  (from  0.836  thru 

2.500  sec  MET) 
38:02.743     Last  positive  evidence  of  smoke  above 

right  aft  SRB/ET  attach  ring 
38:03.385     Last  positive  visual  indication  of  smoke 
38:04.349     SSME  104%  Command 
38:05.684     RH  SRM  pressure  11.8  psi  above 

nominal 
38:07.734     Roll  maneuver  initiated 
38:19.869     SSME  94%  Command 
38:21.134     Roll  maneuver  completed 
38:35.389     SSME  65%  Command 
38:37.000     Roll  and  Yaw  Attitude  Response  to  Wind 

(36.990  to  62.990  sec) 
38:51.870     SSME  104%  Command 
38:58.798     First  evidence  of  flame  on  RH  SRM 
38:59.010     Reconstructed  Max  Q  (720  psf) 
38:59.272     Continuous  well  defined  plume  on  RH 

SRM 
38:59.763     Flame  from  RH  SRM  in    +  Z  direction 

(seen  from  south  side  of  vehicle) 
39:00.014     SRM  pressure  divergence  (RH  vs.  LH) 
39:00.248     First  evidence  of  plume  deflection, 

intermittent 
39:00.258     First  evidence  of  SRB  plume  attaching 

to  ET  ring  frame 
39:00.998     First  evidence  of  plume  deflection, 

continuous 
39:01.734     Peak  roll  rate  response  to  wind 


59.262 


E207  Camera 


59.753 

E204  Camera 

60.004 

B47P2302 

60.238 

E207  Camera 

60.248 

E203  Camera 

60.988 

E207  Camera 

61.724 

V90R5301C 

\(   I      POS— Actuator  Position  Ml( 

APU  -Auxiliary  Powei  Unit  Ml  I 

BE  I  —  Bi  -i  Estimated  Traj*  MPS 

'  I!  -Channel  PC 

DISC  -Discharge  I'lt 

1.1  —  External   I  .ink  psl 

( '( »  —Gas  Generator  K(  s 

GP(  —General  Purpose  Computet  K< . A 

(All  —Greenwich  Mean  Time  KM 

lll'l  1  —  High  Pressun   Fuel   ["urbopump  Kss 

LH  -   Lcfthand  sKI'. 

IH  -  Liquid  Hydrogen  sKM 

LO  -Liquid  Oxygen  (same  as  LOX)  ss\|| 

MAX  Q       —  Maximum  Dynamii   Pn  II  Ml' 

Ml  -Main  Engine  (same  as  SSME)  l\( 


—  Main  Engine  Controllei 

—  Mission  Elapsed  Time 

—  Main  Propulsion  System 

—  (  hambei  Pressure 

—  Pyrotechnics  Initiatoi  Controller 

—  Pound'-  per  square  fool 

—  k.  .ic  tion  <  unirol  System 

—  Ran   <■'.!"  Assembly 

—  Righthand 

—  Range  S.ili  r,   S 

—  Solid  Roc  ket  B 
Solid  Ri  ■<  ki  i  Motoi 

—  S|i.n .  Shuttle  Main  Engine 

I  HUM' 

— Thrusl  Vector  Control 


N<  )  I  E:  The  Shuttle  coordinate  system  used  in  Chapter 
relative  to  the  Orbiter,  as  follows: 
+  X  direction  =  forward  (tail  to  nose) 

-  X  dim  tion  -  rearward  (nose  to  tail  i 

*  Y  din  <  lion  =  right  (toward  the  right  wing  tip) 

Y  direc  tion  =  lr!t  (toward  the  left  wing  tip) 
+  Z  direction  -  down 

-  Z  direction  =  up 
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Mission 

i  G  U '/'.  in  hr  min 

39:02.094 
39:02.414 
39:02.494 

39:03.934 

39:03.974 
39:04.670 

39:04.715 
39:04.947 

39:05.174 

39:05.534 

39:06.774 

39:12.214 

39:12.294 


39 
39 
39 


12.488 
12.507 
12.535 


39:12.574 
39:12.574 

39:12.634 
39:12.974 

39:13.020 
39:13.054 

39:13.055 

39:13.134 

39:13.134 

39:13.147 
39:13.153 

39:13.172 

39:13.201 
39:13.221 


Peak  TVC  response  to  wind 
Peak  yaw  rate  response  to  wind 
RH  outboard  elevon  actuator  hinge 

moment  spike 
RH  outboard  elevon  actuator  delta 

pressure  change 
Start  of  planned  pitch  rate  maneuver 
Change  in  anomalous  plume  shape 

(LH2  tank  leak  near  2058  ring  frame) 
Bright  sustained  glow  on  sides  of  ET 
Start  SSME  gimbal  angle  large  pitch 

variations 
Beginning  of  transient  motion  due  to 

changes  in  aero  forces  due  to  plume 
LH  outboard  elevon  actuator  delta 

pressure  change 
Start  ET  LH2  ullage  pressure 

deviations 
Start  divergent  yaw  rates  (RH  vs.  LH 

SRB) 
Start  divergent  pitch  rates  (RH  vs.  LH 

SRB) 
SRB  major  high-rate  actuator  command 
SSME  roll  gimbal  rates  5  deg/sec 
Vehicle  max   +  Y  lateral  acceleration 

.  (  +  -227§). 

SRB  major  high-rate  actuator  motion 

Start  of  H2  tank  pressure  decrease  with 

2  flow  control  valves  open 
Last  state  vector  downlinked 
Start  of  sharp  MPS  LOX  inlet  pressure 

drop 
Last  full  computer  frame  of  TDRS  data 
Start  of  sharp  MPS  LH2  inlet  pressure 

drop 
Vehicle  max    -  Y  lateral  acceleration 

(  -  -254  g) 
Circumferential  white  pattern  on  ET  aft 

dome  (LH2  tank  failure) 
RH  SRM  pressure  19  psi  lower  than 

LH  SRM 
First  hint  of  vapor  at  intertank 
All  engine  systems  start  responding  to 

loss  of  fuel  and  LOX  inlet  pressure 
Sudden  (loud  along  ET  between 

intertank  and  aft  dome 
Flash  between  Orbiter  and  LH2  tank 
SSME  telemetry  data  interference  from 

73.211  to  73.303 


Elapsed 
Time  (sees.) 

Source 

62.084 
62.404 

B58H1150C 
V90R5341C 

62.484 

V58P0966C 

63.924 
63.964 

V58P0966C 
V90R5321C 

64.660 
64.705 

E204  Camera 
E204  Camera 

64.937 

Y58H1100A 

65.164 

V90R5321C 

65.524 

Y58P0866C 

66.764 

T41P1700C 

72.204 

V90R2528C 

72.284 
72.478 
72.497 

Y90R2525C 
V79H2111A 

V58H1100A 

72.525 
72.564 

V98A1581C 
B58H1151C 

72.564 
72.624 

T41P1700C 
Data  reduction 

72.964 
73.010 

Y41P1330C 
Data  reduction 

73.044 

Y41P1100C 

73.045 

Y98A1581C 

73.124 

E204  Camera 

73.124 
73.137 

B47P2302C 
E207  Camera 

73.143 

SSME  team 

73.162 
73.191 

E207  Camera 
E204  Camera 

73.211 
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Mission  Time 

i  GMT.  in  hr:min:sec) 


Event 


Elapsed 
Time  (sees.) 


Sour 


39:13.223     Flash  near  SRB  fwd  attach  and 

brightening  of  flash  between  Orbiter 

and  ET  73.213 

39:13.292      First  indication  intense  white  flash  at 

SRB  fwd  attach  point  73.282 

39:13.337     Greatly  increased  intensity  of  white  Hash  73.327 

39:13.387     Start  RCS  jet  chamber  pressure 

fluctuations  73.377 

39:13.393     All  engines  approaching  HPFT 

discharge  temp  redline  limits  73.383 

39:13.492     ME-2  HPFT  disch.  temp  Chan.  A  vote 

for  shutdown:  2  strikes  on  Chan.  B  73.482 

39:13.492     ME-2  controller  last  time  word  update  73.482 

39:13.513     ME-3  in  shutdown  due  to  HPFT 

discharge  temperature  redline 

exceedance  73.503 

39:13.513     ME-3  controller  last  time  word  update  73.503 

39:13.533     ME-1  in  shutdown  due  to  HPFT 

discharge  temperature  redline 

exceedance  73.523 

39:13.553     ME-1  last  telemetered  data  point  73.543 

39:13.628     Last  validated  Orbiter  telemetry 

measurement  73.618 

39:13.641      End  of  last  reconstructed  data  frame 

with  valid  synchronization  and  frame 

count  73.631 

39:14.140     Last  radio  frequency  signal  from  Orbiter  74.130 

39:14.597     Bright  flash  in  vicinity  of  Orbiter  nose  74.587 

39:16.447     RH  SRB  nose  cap  sep/chute  deplovment  76.437 

39:50.260     RH  SRB  RSS  destruct  110.250 

39:50.262     LH  SRB  RSS  destruct  110.252 


E204  Camera 

E204  Camera 
E204  Camera 

V42P1552A 

E41Tn0l0D 

MEC  data 
MEC  data 


MEC  data 
MEC  data 


Calculation 
Calculation 

V46P0120A 


Data  reduction 
Data  reduction 
E204  Camera 
E207  Camera 
E202  Camera 
E230  Camera 


Shuttle  to  Ground  Telemetry  Channels 

Channel                 SampU  Rate     Sample           Description 
Identifier                                            Period 
(Samples/see)      (sic) 


Shuttle  to  Ground  Telemetry  Channels 


B47P1302C 

12  5 

.080 

B47P2302C 

12  5 

.080 

B58H1150C 

25 

.040 

B58H1151C 

25 

040 

E41M2076D 

25 

.040 

E41T1010D 

25 

.040 

E41T2010D 

25 

.040 

E41T3010D 

25 

.040 

T41P170OC 

5 

.200 

V41P1100C 

12  5 

.080 

V41P1330C 

12  5 

.080 

V42P1552A 

25 

040 

V46P0120A 

100 

.010 

LH  SRM  CHAMBER  PRESSURE 
RH  SRM  CHAMBER  PRESSURE 

LH  SRB  TVC  TILT  ACT  POS 
LH  SRB  TVC  ROCK  ACT  POS 

ME-3  VEHICLE  COMMAND 
ME-1  HPFT  DISC  TEMP-CH  A 
ME-2  HPFT  DISC  TEMP-CH  A 
ME-3  HPFT  DISC  TEMP-CH  A 

ET  LH2  ULLAGE  PRESSURE 

MPS  LH2  INLET  PRESS  (ME-1) 
MPS  L02  INLET  PRESS  (ME-3) 

RCS  THRUSTER  PC 

APU-1  GG  CHAMBER  PRESS 


Channel 
Identifier 

Sample  Rate 
(Samples/sec) 

Sample 
Penod 
(*c) 

Description 

V58H1100A 
V58P0866C 
V58P0966C 

25 
12  5 
12.5 

040 
.080 
.080 

ME-PITCH  ACTUATOR  POS 
LH  OB  ELEVON  PRI  DELTA  P 
RH  OB  ELEVON  PRI  DELTA  P 

V79H2111A 

25 

.040 

LH  SRB  TILT  ACT  DRIVER 

V90R2525C 

V90R2528C 

5 
5 

.200 
.200 

SEL  LH  SRB  PITCH  RATE 
SEL  RH  SRB  YAW  RATE 

V90R5301C 
V90R5321C 
V90R5341C 

5 
5 
5 

.200 
.200 
.200 

SELECTED  RGA  ROLL  RATE 
SELECTED  RGA  PITCH  RATE 
SELECTED  RGA  YAW  RATE 

V95H3522C 
V95H3523C 

12.5 
12.5 

.080 
.080 

BODY  YAW  ATTITUDE  ERROR 
BODY  ROLL  ATTITUDE  ERROR 

V98A1581C 

25 

040 

LATERAL  ACCELERATION 
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Chapter  IV 


The  Cause  of 
the  Accident 


The  consensus  of  the  Commission  and 
participating  investigative  agencies  is 
that  the  loss  of  the  Space  Shuttle 
Challenger  was  caused  by  a  failure  in 
the  joint  between  the  two  lower  segments  of  the 
right  Solid  Rocket  Motor.  The  specific  failure  was 
the  destruction  of  the  seals  that  are  intended  to 
prevent  hot  gases  from  leaking  through  the  joint 
during  the  propellant  burn  of  the  rocket  motor. 
The  evidence  assembled  by  the  Commission  in- 
dicates that  no  other  element  of  the  Space  Shut- 
tle svstem  contributed  to  this  failure. 


In  arriving  at  this  conclusion,  the  Commission 
reviewed  in  detail  all  available  data,  reports  and 
records;  directed  and  supervised  numerous  tests, 
analyses,  and  experiments  by  NASA,  civilian 
contractors  and  various  government  agencies; 
and  then  developed  specific  failure  scenarios  and 
the  range  of  most  probable  causative  factors.  The 
sections  that  follow  discuss  the  results  of  the 
investigation. 


Analysis  of  the  Accident 

The  results  of  the  accident  investigation  and 
analysis  will  be  presented  in  this  and  the  follow- 
ing sections.  Throughout  the  investigation  three 
critical  questions  were  central  to  the  inquiry, 
namely: 

■  What  were  the  circumstances  surrounding 
mission  51-L  that  contributed  to  the 
catastrophic  termination  of  that  flight  in 
contrast  to  24  successful  flights  preceding  it? 

■  What  evidence  pointed  to  the  right  Solid 
Rocket  Booster  as  the  source  of  the  accident 
as  opposed  to  other  elements  of  the  Space 
Shuttle.' 

■  Finally,  what  was  the  mechanism  of  failure? 

Using  mission  data,  subsequently  completed 
tests  and  analyses,  and  recovered  wreckage,  the 


Commission  identified  all  possible  faults  that 
could  originate  in  the  respective  flight  elements 
of  the  Space  Shuttle  which  might  have  the  poten- 
tial to  lead  to  loss  of  the  Challenger.  Potential  con- 
tributors to  the  accident  examined  by  the  Com- 
mission were  the  launch  pad  (exonerated  in 
Chapter  IX  of  this  report),  the  External  Tank, 
the  Space  Shuttle  Main  Engines,  the  Orbiter  and 
related  equipment,  payload/Orbiter  interfaces, 
the  payload,  Solid  Rocket  Boosters  and  Solid 
Rocket  Motors. 

In  a  parallel  effort,  the  question  of  sabotage  was 
examined  in  detail  and  reviewed  by  the  Commis- 
sion in  executive  session.  There  is  no  evidence  of 
sabotage,  either  at  the  launch  pad  or  during  other  proc- 
esses prior  to  or  during  launch. 
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External  Tank 

The  External  Tank  contains  propellants  used 
by  the  Orbiter's  three  main  engines  during  Shut- 
tle launch  and  ascent  to  orbit.  Structurally  the 
tank  is  attached  to  and  serves  as  the  backbone 
of  the  Orbiter  and  the  two  Solid  Rocket  Boosters. 
Three  primary  structures  — the  liquid  oxygen 
tank,  the  intertank  and  the  liquid  hydrogen 
tank  — comprise  the  configuration.  (Figure  1) 

The  External  Tank  delivers  oxidizer  and  fuel 
from  the  propellant  tanks  to  the  Orbiter.  The 
electrical  subsystem  includes  instrumentation  sen- 
sors, heaters,  range  safety  electronics  and  ex- 
plosives, and  lightning  protection  and  associated 
cabling.  All  flight  instrumentation  and  electrical 
power  are  wired  directly  to  the  Orbiter.  The  ther- 
mal protection  subsystem  is  the  insulation  applied 
to  the  tank's  exterior.  Its  function  is  to  prevent 
heat  leakage  into  the  propellants,  to  protect  the 
External  Tank  from  overheating  during  flight  and 
to  minimize  ice  formation  while  the  Shuttle  is  on 
the  pad. 

Approximately  20  percent  of  the  External  Tank 
structure  was  recovered  after  the  accident  and  the 
majority  of  the  pieces  were  from  the  intertank  and 
liquid  hydrogen  tank.1  The  Commission  initial- 
ly considered  all  External  Tank  systems  and  sub- 
systems in  identifying  possible  faults  or  failures 


potentially  contributing  to  the  Challenger  acci- 
dent. Those  potential  contributors  were: 

■  Premature  detonation  of  the  External  Tank 
range  safety  system 

■  Structural  flaw 

■  Damage  at  lift-off 

■  Load  exceedance 

■  Overheating 

The  Commission  examined  the  possibility  that 
the  STS  51-L  accident  could  have  been  triggered 
by  accidental  detonation  of  the  range  safety 
system  explosives.  This  potential  fault  was  as- 
sessed using  flight  data,  observed  events,  and 
recovered  hardware.  Most  of  the  explosive 
charges  for  the  External  Tank  emergency  destruc- 
tion system  were  recovered.2  Examination  of  this 
material  established  that  none  of  it  had  exploded 
and  thus  could  not  have  contributed  to  the  acci- 
dent (Photo  C  &  D).  Flight  data  verified  that  the 
External  Tank  range  safety  system  was  not 
activated. 

The  possibility  of  an  imperfection  existing  in 
either  the  pressurized  or  nonpressurized  Exter- 
nal Tank  structural  elements  that  could  grow  to 
a  sufficient  size  to  cause  structural  failure  was  ex- 
amined in  detail.  All  construction  history,  struc- 
tural qualification  test  data,  proof  test  inspection 
records  and  x-rays  were  reviewed.  One  previously 


Figure  1 
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undetected  imperfection  that  was  discovered  dur- 
ing a  reexamination  of  the  x-rays  was  found  in 
recovered  hardware  with  no  propagation  in- 
dicated.3 Other  data  from  the  pre-launch  ice  and 
frost  team  inspections,  film  and  video  coverage, 
pressurization  records  and  flight  data  revealed  no 
evidence  of  leakage.  The  Commission  conclud- 
ed that  no  structural  imperfections  existed  that 
could  have  grown  to  a  size  to  create  a  leak  or 
cause  catastrophic  failure  of  the  External  Tank. 

Possible  damage  to  the  liquid  hydrogen  tank 
at  lift  off  was  considered.  The  ice  and  frost  team 
observed  no  vapor  or  frost  that  would  indicate 
a  leak.  The  liquid  hydrogen  vent  arm  retracted 
as  expected  during  launch  and  did  not  recontact 
the  tank  or  solid  booster.4  Photo  analysis  and 
television  monitoring  did  not  indicate  that  any 
debris  contacted  the  tank.  Therefore,  damage  to 
the  liquid  hydrogen  tank  at  lift  off  was  determined 
to  be  highly  improbable. 

The  possibility  that  abnormally  high  structural 
loads  caused  an  External  Tank  failure  was  ex- 
amined. Analysis  indicated  that  there  were  no  ex- 
cessive loading  conditions  based  on  lift  off  and 
flight  data  prior  to  the  explosion.  The  maximum 
structural  load  produced  was  less  than  80  percent 
of  the  allowable  design  load.5  The  structural  im- 
plications of  vent  and  flow  control  valve  opera- 
tion was  examined  and  found  not  to  be  a  factor. 

The  possibility  of  a  structural  failure  due  to 
overheating  was  assessed  with  several  causes 
postulated:  high  heating  due  to  abnormal  trajec- 
tory, loss  of  the  thermal  protection  system,  a  hot 
gas  leak  from  the  Solid  Rocket  Motor  and  a  liq- 
uid hydrogen  leak  from  the  External  Tank.  The 
trajectory  was  normal  until  well  after  the  Solid 
Rocket  Motor  leak  was  observed  at  58  seconds. 
Maximum  aerodynamic  heating  would  not  have 
occurred  until  approximately  90  seconds.6  At  73 
seconds,  heating  was  well  within  tank  component 
structural  capability.  Based  on  careful  review  of 
pre-launch  and  flight  films  and  data,  the  Com- 
mission found  no  evidence  that  any  thermal  pro- 
tection foam  was  lost  during  the  launch  and 
,im  ent. 

The  possibility  of  a  leak  from  the  hydrogen 
tank  resulting  in  overheating  was  addressed. 
Tests  indicated  that  small  leaks  (0.037  lbs/second) 
would  have  been  visible.  In  addition,  if  there  was 
a  liquid  hydrogen  leak  at  lift  off,  it  would  have 
been  ignited  by  either  the  Solid  Rocket  Booster 
ignition  or  Space  Shuttle  Main  Engine  ignition.7 


The  resultant  flame  would  have  ignited  the  Solid 
Rocket  Booster  attach  ring  foam  insulation  almost 
immediately.  Copious  quantities  of  dense  black 
smoke  and  open  flames  would  be  evident  in  such 
a  case  and  would  have  continued  for  as  long  as 
the  leak  burned.  Smoke  and  flames  in  these  quan- 
tities were  not  observed  at  lift  off  nor  anytime 
throughout  the  flight.  It  is  therefore  concluded 
that  an  initial  liquid  hydrogen  tank  leak  was  im- 
probable, and  that  the  only  possible  cause  for 
overheating  the  tank  was  the  impingement  of 
leaking  Solid  Rocket  Motor  gases.  This  resulted 
in  the  ultimate  breakup  of  the  External  Tank. 

The  recovered  external  foam  insulation  on  the 
External  Tank  was  scorched  and  discolored  in 
various  locations.8  Burn  patterns  across  the  pieces 
of  insulation  on  the  External  Tank  indicate  that 
various  areas  were  subjected  to  fire  both  before 
and  after  the  External  Tank  broke  up  in  flight. 

The  Commission  reviewed  the  External  Tank's  con- 
struction records,  acceptance  testing,  pre-launch  and  flight 
data,  and  recovered  hardware  and  found  nothing  relating 
to  the  External  Tank  that  caused  or  contributed  to  the 
cause  of  the  accident. 


Space  Shuttle  Main  Engines 

A  cluster  of  three  Space  Shuttle  Main  Engines 
operates  simultaneously  with  the  Solid  Rocket 
Boosters  during  the  initial  ascent  phase  of  flight 
and  provides  primary  propulsion  until  the  Shut- 
tle has  attained  orbital  velocity.  These  engines 
use  liquid  hydrogen  as  the  fuel  and  liquid  oxygen 
as  the  oxidizer.  Both  the  liquid  hydrogen  and  oxy- 
gen are  stored  in  the  External  Tank  and  are 
transferred  to  the  engines  under  pressure.  Dur- 
ing the  mission  the  engines  operate  for  about  8.5 
minutes. 

Engine  thrust  is  controlled  by  throttling  and 
has  ranged  from  65  to  104  percent  of  a  specified 
thrust  level.  At  sea  level,  100  percent  equals 
375,000  pounds  of  thrust  per  engine. 

Pitch,  yaw  and  roll  control  of  the  Orbiter  is 
provided  by  gimbals  on  each  engine.  Gimbaling 
is  operated  by  two  hydraulic  servoactuators,  one 
for  pitch  motion  and  the  other  for  yaw  motion, 
with  roll  controlled  by  a  combination  of  both  pitch 
and  yaw.  These  servoactuators  are  commanded 
by  the  Orbiter's  computer. 

An  electronic  controller  is  attached  to  the  for- 
ward end  of  each  engine.  Each  controller  is  a  self- 
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Schematic  drawing  depicts  liquid  oxygen  and  liquid 
hydrogen  tanks  and  the  feedlines  connecting  them  to  the 
Space  Shuttle  Main  Engines. 
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Rear  view  drawing  identifies  the  positions  and  numbers  of 
the  engines  mounted  on  the  Orbiter  Challenger  for  the  flight 
of  Mission  51-L. 


contained  system  that  monitors  engine  checkout, 
control  and  status,  and  sends  the  data  to  the  Or- 
biter. Each  of  the  three  engine  interface  units  in 
turn  sends  its  data  to  the  Orbiter  computers  and 
relays  commands  from  the  computers  to  the 
engines. 

A  propellant  management  subsystem  of 
manifolds,  distribution  lines  and  valves  controls 
the  flow  of  liquids  from  the  External  Tank  to  the 
engines,  and  the  flow  of  gaseous  hydrogen  and 
oxygen  from  the  engines  into  the  External  Tank 
to  maintain  pressurization. 

All  three  main  engines  from  the  Challenger, 
No.  2020  in  position  2,  No.  2021  in  position  3, 
and  No.  2023  in  position  1,  were  recovered  in 
large  part  on  February  23,  1986,  off  the  Florida 
coast  in  about  85  feet  of  water.  All  parts  were 
recovered  close  to  one  another,  and  the  engines 
were  still  attached  to  the  thrust  structure.9  All 
engine  gimbal  bearings  had  failed,  apparently 
because  of  overload  on  water  impact. 

All  metallic  surfaces  were  damaged  by  marine 
life,  except  titanium  surfaces  or  those  parts  that 
were  buried  under  the  ocean  bottom.  The  metal 
fractures,  examined  at  3x  magnification,  showed 
rough  texture  and  shear  lips,  which  appeared  to 
be  caused  by  overloads  due  to  water  impact.10 
No  pre-accident  material  defects  were  noted. 

The  engine  nozzles  were  sheared  at  the 
manifolds.  The  main  combustion  chambers, 
main  injectors  and  preburners  of  each  engine 
were  attached  to  one  another.  The  six  hydraulic 
servoactuators  used  to  control  engine  gimbaling 


were  attached  to  segments  of  the  Orbiter  thrust 
structure.11 

Sections  of  the  main  propulsion  system  fuel  and 
liquid  oxygen  feedlines  and  feedline  manifolds 
were  recovered,  as  well  as  the  External  Tank/Or- 
biter  disconnect  assembly  in  the  mated  configura- 
tion. A  portion  of  the  oxidizer  inlet  duct  was  at- 
tached to  the  interface  of  engine  2020.  All 
preburner  valves  were  recovered.12 

The  main  engine  controllers  for  both  engines 
2020  and  2021  were  recovered.  One  controller 
was  broken  open  on  one  side,  and  both  were 
severely  corroded  and  damaged  by  marine  life. 
Both  units  were  disassembled  and  the  memory 
units  flushed  with  deionized  water.  After  they 
were  dried  and  vacuum  baked,  data  from  these 
units  were  retrieved.13 

All  engines  had  burn  damage  caused  by  inter- 
nal overtemperature  typical  of  oxygen-rich  shut- 
down. Thus,  the  loss  of  hydrogen  fuel  appears 
to  have  initiated  the  shutdown.  The  Commission 
reviewed  engine  and  ground  measurements  made 
while  the  three  engines  were  prepared  for  launch. 
Ambient  temperature  during  pre-launch  was  the 
coldest  to  date,  but  preflight  engine  data  were 
normal.14  These  data  were  also  compared  with 
Challenger  engine  data  during  the  flight  61 -A 
pre-flight  period.  All  differences  seen  between  the 
two  missions  were  due  either  to  planned  varia- 
tions in  the  pre-launch  sequence  or  the  cold  am- 
bient conditions  during  the  preflight  period  for 
flight  51-L.  These  differences  did  not  affect  engine 
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performance  during  the  powered  flight  phase  of 
the  mission. 

Preflight  data  gave  no  evidence  of  any  pro- 
pellant  leaks  (fuel  or  oxidizer)  in  the  aft  compart- 
ment. For  the  powered  flight  phase  all  the 
parameters  of  the  engine  aft  compartment  that 
could  give  an  indication  of  a  leak  were  selected 
from  the  overall  flight  51-L  measurement  list. 
The  majority  of  those  parameters  were  either 
ground  measurements  or  those  recorded  during 
the  flight  but  not  telemetered  to  the  ground.15 
Among  parameters  that  were  telemetered  during 
the  flight  were  skin  temperature  measurements 
that  gave  no  indication  of  a  hot  gas  or  other  leak 
in  the  engine  compartment. 


Analysis  of  the  engine  start  data  showed  all 
three  engine  starts  were  normal  and  no  anomalies 
were  found. 

An  assessment  of  the  engine  performance  in 
the  final  seconds  of  the  mission  before  the  acci- 
dent was  compared  with  similar  periods  on  all 
flights  of  the  Challenger  engines.  The  assessment 
showed  the  engine  performance  on  flight  51-L 
was  consistent  with  previous  flights.16 

The  first  abnormal  engine  indication  was  a 
drop  in  engine  fuel  tank  pressure  at  72.564 
seconds.  As  fuel  pressure  dropped,  the  control 
system  automatically  responded  by  opening  the 
fuel  flowrate  valve.  The  turbine  temperatures 
then  increased  because  of  the  leaner  fuel  mixture. 
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identifies  principal  elements  in  Space  Shuttle  Main 
three  of  which  are  mounted  on  the  aft  of  each  Or- 
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1 — Low-Pressure  Fuel  Turbopump 

2 — High-Pressure  Fuel  Turbopump 

3 — Main  Fuel  Valve 

4 — Coolant  Control  Valve 

5 — Nozzle  Tube 

6 — Main  Combustion  Chamber 

7 — Fuel  Preburner  Valve 

8 — Fuel  Preburner 

9— Hot-Gas  Manifold 
10 — Main  Injector 

1 1  — Low-Pressure  Oxidizer  Turbopump 
12 — High-Pressure  Oxidizer  Turbopump 
13 — Main  Oxidizer  Valve 
14 — Oxidizer  Preburner  Valve 
15 — Oxidizer  Preburner 
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The  increased  temperature  caused  an  increase  in 
pump  speed.  This  could  not,  however,  increase 
the  fuel  pressure  because  of  a  decrease  in  fuel  tank 
top  (ullage)  pressure  resulting  from  the  burned 
through  hydrogen  tank  leakage.  When  the  fuel 
pump  pressures  dropped  below  140  pounds  per 
square  inch,  the  programed  control  system  dis- 
qualified the  measured  data  because  it  was  past 
reasonable  limits.  This  caused  the  fuel  flowrate 
and  high-pressure  fuel  pump  discharge  pressure 
to  decrease,  while  the  lack  of  load  allowed  the 
pump's  speed  to  increase.  The  decreased  fuel  flow 
caused  a  drop  in  fuel  preburner  chamber 
pressure,  though  the  fuel  preburner  oxygen  valve 
was  then  advancing  toward  a  more  open  position. 
The  mixture  ratio  in  the  fuel  preburner  became 
leaner,  which  raised  high-pressure  fuel  turbine 
discharge  temperatures  above  the  redline  limits. 
This  caused  the  engine  control  system  to  start 
automatic  shutdown  of  the  engine. 

The  engine  flight  history  showed  that  engine 
2023  flew  four  previous  times  while  engines  2020 
and  2021  had  flown  five  previous  missions.17  The 
flight  data  from  flight  51-L  compared  well  with 
flight  data  from  all  previous  flights. 

The  analysis  of  flight  data  confirmed  that  the 
Space  Shuttle  Main  Engines  operated  properly 
while  reacting  to  changing  external  conditions. 
Previous  engine  tests  suggest  that  the  high- 
pressure  pumps  are  the  most  likely  components 
to  fail,  because  of  either  bearing  or  turbine  blade 
failure.  There  was  no  evidence  of  either  in  flight 
51-L.  Engine  operation  was  normal  until  the  fuel 
inlet  pressure  dropped.  As  the  pressure  decreased, 
the  engine  responded  in  a  predictable  manner. 
Automatic  shutdown  of  engine  2023  was  verified 
by  telemetry  data.  Data  recovered  from  the 
salvaged  engine  2021  control  computer  verify  that 
this  engine  also  had  begun  shutdown.  Salvaged 
control  computer  data  from  engine  2020  showed 
that  this  engine  was  within  20  milliseconds  of 
shutdown  when  the  computer  stopped.18  Inspec- 
tion of  recovered  engine  hardware  verified  that 
all  engines  were  shut  down  in  a  fuel-lean  or 
oxygen-rich  condition  which  resulted  in  burn 
through  and  erosion  of  the  engine  hot  gas  circuits. 

The  Commission  concluded  that  the  Space  Shuttle 
Main  Engines  did  not  cause  or  contribute  to  the  cause 
of  the  Challenger  accident. 

Orbiter  and  Related  Equipment 

The  Orbiter  subsystems  include  propulsion 
and  power,  avionics,  structures,  thermal  and  en- 
vironmental control  and  life  support,  mechanical 


and  interface,  and  other  government  furnished 
essential  equipment.  Onboard  government  fur- 
nished equipment  for  STS  51-L  included  the 
remote  manipulator  arm  system,  extravehicular 
mobility  units,  extravehicular  activity  hardware, 
television,  equipment  worn  by  the  crew,  storage 
provisions  and  communication  equipment. 

The  significant  pieces  of  Orbiter  structure 
recovered  included  all  three  Space  Shuttle  Main 
Engines,  the  forward  fuselage  including  the  crew 
module,  the  right  inboard  and  outboard  elevons, 
a  large  portion  of  the  right  wing,  a  lower  portion 
of  the  vertical  stabilizer,  three  rudder  speed  brake 
panels  and  portions  of  mid-fuselage  side  walls 
from  both  the  left  and  right  sides.19  This 
represents  about  30  percent  of  the  Orbiter  but 
does  not  provide  sufficient  evidence  to  establish 
conclusively  the  complete  failure  sequence  of  the 
entire  Orbiter  spacecraft.  However,  there  was 
sufficient  evidence  to  establish  some  of  the  struc- 
tural failure  modes  that  resulted  in  the  Orbiter's 
destruction. 

All  fractures  and  material  failures  examined  on 
the  Orbiter,  with  the  exception  of  the  main 
engines,  were  the  result  of  overload  forces,  and 
they  exhibited  no  evidence  of  internal  burn 
damage  or  exposure  to  explosive  forces.  This  in- 
dicated that  the  destruction  of  the  Orbiter  oc- 
curred predominantly  from  aerodynamic  and  in- 
ertial  forces  that  exceeded  design  limits.  There 
was  evidence  that  during  the  breakup  sequence, 
the  right  Solid  Rocket  Booster  struck  the  out- 
board end  of  the  Orbiter's  right  wing  and  right 
outboard  elevon.  Additionally,  chemical  analysis 
indicated  that  the  right  side  of  the  Orbiter  was 
sprayed  by  hot  propellant  gases  exhausting  from 
the  hole  in  the  inboard  circumference  of  the  right 
Solid  Rocket  Booster.  Evaluation  of  the  Orbiter 
main  engines  showed  extensive  internal  thermal 
damage  to  the  engines  as  a  consequence  of 
oxygen-rich  shutdown  that  resulted  from  a  deple- 
tion of  the  hydrogen  fuel  supply.  The  supply  of 
hydrogen  fuel  to  the  main  engines  would  have 
been  abruptly  discontinued  when  the  liquid 
hydrogen  tank  in  the  External  Tank  disinte- 
grated. 

The  crew  module  wreckage  was  found 
submerged  in  about  90  feet  of  ocean  water  con- 
centrated in  an  area  of  about  20  feet  by  80  feet. 
Portions  of  the  forward  fuselage  outer  shell  struc- 
ture were  found  among  the  pieces  of  crew  module 
recovered.20  There  was  no  evidence  of  an  inter- 
nal explosion,  heat  or  fire  damage  on  the  forward 
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Figure  5 

1  Orbital  Maneuvering  System 

Two  engines 

Thrust  level  =  6.000  pounds  each 

Propellants 
Monomethyl  hydrazine  (fuel)  and 
nitrogen  tetroxide  (oxidizer 

2  Reaction  Control  System 

One  forward  module,  two  aft  pods 

38  primary  thrusters  (14  forward.  12  per  aft  pod) 
Thrust  level  =  870  pounds  each 

Six  vernier  thrusters  (two  forward,  four  aft) 
Thrust  level  =  25  pounds  each 

Propellants 
Monomethyl  hydrazine  (fuel)  and 
nitrogen  tetroxide  (oxidizer) 


3  Main  Propulsion 

Three  engines 
Thrust  level  =  375.000  pounds  each 

Propellants 
Liquid  hydrogen  (fuel)  and 
liquid  oxygen  (oxidizer) 


Space  Shuttle  Orbiter  drawing  identifies  location  of  principal 
maneuvering,  reaction  control  and  propulsion  system 
engines. 


fuselage/crew  module  pieces.  The  crew  module 
was  disintegrated,  with  the  heaviest  fragmenta- 
tion and  crash  damage  on  the  left  side.  The  frac- 
tures examined  were  typical  of  overload  breaks 
and  appeared  to  be  the  result  of  high  forces 
generated  by  impact  with  the  surface  of  the  water. 
The  sections  of  lower  forward  fuselage  outer  shell 
found  floating  on  the  ocean  surface  were 
recovered  shortly  after  the  accident.  They  also 
contained  crush  damage  indicative  of  an  impact 
on  the  left  side.  The  consistency  of  damage  to  the 
left  side  of  the  outer  fuselage  shell  and  crew 
module  indicates  that  these  structures  remained 
attached  to  each  other  until  impact  with  the 
water. 

The  Orbiter  investigation  consisted  of  a  review 
of  .ill  Orbiter  data  and  vehicle  parts  retrieved. 
Also  reviewed  were  vehicle  and  equipment  proc- 
essing records  and  pre-mission  analyses. 

All  orbital  maneuvering  system  measurements 
such  as  temperatures,  pressures,  events,  com- 
mands, stimuli,  and  switch  positions  were-  re- 
viewed  with   all   related  computer  data.   There 


were  no  indications  of  abnormal  behavior.  All 
temperature  and  pressure  transducers  active  dur- 
ing ascent  for  the  reaction  control  system  were 
reviewed,  including  thruster  chamber  pressure, 
leak  temperature,  line  temperature,  propellant 
tank,  helium  tank  and  propellant  line  trans- 
ducers. Nothing  was  found  that  could  have  con- 
tributed to  the  accident. 

Auxiliary  power  unit  pressures  and 
temperatures  were  reviewed,  and  no  abnormal 
conditions  were  observed  during  ascent.  Selected 
hydraulic  measurements,  including  system 
pressures,  fluid  quantities  and  most  temperatures 
in  the  aft  compartment  and  in  the  wing  cavity 
containing  the  elevon  actuator  supply  lines,  were 
reviewed  by  the  Commission,  and  no  abnormali- 
ty was  found.  All  fuel  cells  and  power  reactant 
storage  and  distribution  subsystem  measurements 
were  reviewed  and  found  to  be  normal  during  all 
phases  of  ground  and  flight  operation  prior  to  the 
accident.  All  available  pyrotechnic  firing  control 
circuit  measurements  were  reviewed,  along  with 
radiography,  shear  bolt  review  and  debris  reports, 
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Sketch  of  Space  Shuttle  Orbiter  in  the  landing  configuration 
viewed  from  -Y  position  identifies  aerodynamic  flight  surfaces. 


and  there  were  no  unintentional  firing  command 
indications.21  All  available  data  regarding  range 
safety  and  recovery  system  batteries  were  re- 
viewed, and  no  indications  were  found  that  the 
batteries  were  involved  in  initiating  the  accident. 

Guidance,  navigation  and  control  subsystems 
data  were  reviewed,  and  it  appears  that  the  sub- 
systems performed  properly.  All  subsystem  sen- 
sors and  software  apparently  performed  as  design- 
ed until  data  loss.  Inertial  measurement  unit  data 
from  the  preflight  calibration  through  signal  loss 
were  found  to  be  normal.  All  data  processing 
system  related  data  were  reviewed,  and  nothing 
significant  was  found.  Data  review  of  the  elec- 
trical power  distribution  and  control  subsystem 
indicated  that  its  performance  was  normal  until 
the  time  of  the  accident.22  All  communication  and 
tracking  system  parameters  active  during  launch 
were  evaluated  and  found  to  be  normal.  No  in- 
strumentation abnormalities  were  observed  dur- 
ing the  pre-launch  and  launch  period  before 
signal  loss. 

Structures    evaluation    included    analysis    of 


ground  and  flight  data  (loads,  temperatures, 
pressures  and  purge  flows),  hardware  changes 
and  discrepancy  reports  since  the  last  Challenger 
flight,  and  wreckage.  The  Commission  found  that 
no  Orbiter  structural  elements  contributed  to  the 
accident. 

Orbiter  structural  pre-launch  temperature 
measurements  were  evaluated  and  found  to  be 
within  specified  limits. 

Data  related  to  the  atmospheric  revitalization 
system,  which  maintains  cabin  atmosphere,  were 
evaluated.23  During  pre-launch,  launch  and  un- 
til signal  loss,  data  indicated  that  both  of  the  water 
coolant  loops  were  normal,  the  pressure  control 
system  functioned  normally,  all  fans  functioned 
normally,  and  all  switches  and  valve  positions 
were  proper. 

Active  thermal  control  subsystem  data  in- 
dicated that  both  of  the  freon  coolant  loops  func- 
tioned normally,  the  ammonia  boiler  system  was 
normal,  and  all  switch  and  valve  positions  were 
proper.24 

The  water  management  subsystem  functioned 
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normally  during  the  flight.  The  smoke  detection 
and  fire  suppression  subsystem  and  airlock  sup- 
port subsystem  both  functioned  normally.  The 
waste  collection  subsystem  is  inoperative  during 
the  launch  phase,  and  no  data  were  available.25 

No  mechanical  system  abnormalities  were 
identified.  The  vent  doors  remained  open 
throughout  the  launch.  The  payload  bay  doors 
remained  latched.  All  landing  gear  were  up  and 
locked,  all  doors  remained  closed  and  locked,  and 
the  remote  manipulator  system  and  payload 
retention  system  remained  latched.  Film  and  Or- 
biter  interface  data  showed  that  there  was  no 
premature  Orbiter/External  Tank  separation. 

Video  tapes  and  photographs  indicated  the 
crew  egress  hatch,  which  caused  the  launch  delay 
on  the  preceding  day,  operated  properly. 

The  onboard  government  furnished  equipment 
configuration  and  pre-launch  processing  were 
reviewed  and  determined  to  have  been  flight- 
ready  with  no  unusual  or  abnormal  conditions. 

Based  on  this  review  and  assessment,  the  Commis- 
sion concluded  that  neither  the  Orbiter  nor  related  equip- 
ment caused  or  contributed  to  the  cause  of  the  accident. 

Payload/Orbiter  Interfaces 

Interfaces  between  the  Orbiter  and  the  payload 
serve  to  attach  the  cargo  to  the  Orbiter  or  pro- 
vide services  from  the  Orbiter  to  cargo  items. 
These  interfaces  are  mechanical,  thermal, 
avionics,  power  and  fluid  systems. 

The  Spartan-Halley  payload  was  located  in  the 
front  of  the  payload  bay,  attached  to  the  equip- 
ment support  structure  carrier.  The  Tracking  and 
Data  Relay  Satellite  (TDRS)  was  attached  to  the 
Inertial  Upper  Stage  (IUS)  booster  rocket  used 
to  move  the  TDRS  into  geosynchronous  orbit. 
In  the  aft  flight  deck,  payload  interfaces  consisted 
of  a  standard  switch  panel,  a  payload  deployment 
and  retention  system,  and  display  and  control 
panels  for  use  with  the  payload.  Payloads  in  the 
middeck  area  were  in  the  stowage  lockers.  These 
were  radiation  monitoring,  phase  partitioning, 
fluid  dynamics  experiments,  three  student  ex- 
periments,  the  Teacher  in  Space  Project  and  the 
Comet  Halley  monitoring  program. 

Thermal  interfaces  between  the  Orbiter  and 
the  payload  in  the  aft  flight  deck  and  middeck 
consisted  of  the  Orbiter's  purge,  vent  and  fluid 
heat  exchanger  systems.  Thermal  interface  for 
TDRS/IUS,  Spartan-Halley,  and  the  ex- 
periments and  projects  were  provided  by  the  Or- 
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biter  environment  control  and  life  support 
system. 

Electrical  power  and  avionics  were  provided 
to  the  payload  through  standard  interface  panels 
along  both  side  of  the  cargo  bay.  In  the  aft  flight 
deck,  the  control  and  display  panels  supplied  by 
the  Orbiter  provided  the  avionics  and  power  in- 
terfaces for  TDRS/IUS.  The  experiments  and 
projects  constituting  the  middeck  payload  had  no 
interfaces  with  avionics  and  power  systems. 

The  only  direct  payload  loads  data  from  STS 
51-L  were  accelerometer  data  recorded  through 
the  Orbiter  umbilical  prior  to  lift  off.  Ac- 
celerometer data  from  the  payload  bay  and  the 
crew  cabin  compared  favorably  with  previous 
flights.  Results  indicate  that  payload  loads  on 
STS  51-L  were  similar  to  those  of  STS-6  and  were 
within  design  levels  and  pre-launch  predictions. 

The  Commission  found  that  all  payload 
elements  had  been  certified  safe  for  flight,  and 
records  for  integration  of  hardware  met  engineer- 
ing requirements.  Temperatures  during  pre- 
launch  and  ascent  were  normal.  Reconstructed 
lift  off  loads  were  below  those  used  in  the  flight 
readiness  certification.  The  relay  satellite's  rate 
gyro  data  correlated  with  those  for  the  Orbiter 
and  boosters  during  ascent.  Fittings  attaching  the 
payloads  to  the  Orbiter  remained  in  operation, 
as  shown  by  telemetered  data  from  monitoring 
microswitches. 

The  Commission  found  no  discrepancies  in  the  Or- 
biter/payload  interface  performance  that  might  have  con- 
tributed to  the  Challenger  accident. 


Payloads,  Inertial  Upper  Stage,  and 
Support  Equipment 

The  payload  bay  of  the  Orbiter  Challenger 
contained  a  Tracking  and  Data  Relay  Satellite 
(TDRS)  attached  to  an  Inertial  Upper  Stage 
(IUS)  booster  rocket,  and  associated  airborne 
support  equipment.  The  IUS  contained  two  solid 
rocket  motors  (SRMs):  SRM-1  and  SRM-2. 
The  combined  weight  of  these  components  was 
about  40,000  pounds.  About  five  percent  of  the 
payload,  IUS,  and  support  equipment  package 
was  recovered  from  the  ocean.  Components 
recovered  included  segments  of  the  cases  of  both 
IUS  SRMs,  the  ignition  safe/arm  device  for  each 
SRM,  the  igniter  for  SRM-2,  fragments  of  un- 
burned  propellant  from  each  SRM,  five  explosive 
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separation  bolts  that  secure  the  two  SRMs 
together,  the  forward  support  equipment  trun- 
nions, the  aft  trunnions  with  spreader  beams,  and 
an  undetonated  section  of  explosive  fasteners. 

There  was  no  evidence  of  scorching,  burning, 
or  melting  on  any  of  the  components  and  struc- 
ture recovered,  and  all  fractures  were  typical 
overload  fractures.  The  safe  arm  device  for  each 
IUS  SRM  was  in  the  safe  position,  the  five  ex- 
plosive SRM-l/SRM-2  separation  bolts  were  in- 
tact, and  pieces  of  propellant  were  not  burned, 
indicating  that  the  SRMs  had  not  ignited.  The 
two  aft  trunnion  spreader  beams  were  intact  but 
were  bent  in  the  downward  direction  relative  to 
the  Orbiter.  The  right  spreader  beam  was  cracked 
and  deformed  about  7.5  inches,  and  the  left 
spreader  beam  was  cracked  and  deformed  about 
1.5  inches.26  These  deformations  indicate  that  the 
payload  and  upper  stage  package  was  intact  and 
secure  in  the  cargo  bay  while  being  subjected  to 
significant  inertial  flight  loads. 

The  inertial  upper  stage  is  a  two-stage,  solid- 
rocket-propelled,  three-axis  controlled,  inertial- 
ly  navigated  upper  stage  rocket  used  to  deliver 
spacecraft  weighing  up  to  approximately  5,000 
pounds  from  the  Shuttle  parking  orbit  to  geosyn- 
chronous orbit.  It  includes  the  stage  structure; 
solid  rocket  motors;  a  reaction  control  sub- 
system; avionics  for  telemetry,  tracking  and  com- 
mand; guidance,  navigation  and  control;  data 
management;   thrust   vector  control;   electrical 


power  sources  and  electrical  cabling;  and  airborne 
software. 

Assessment  of  possible  upper  stage  contribu- 
tion to  the  accident  centered  on  the  elimination 
of  three  possible  scenarios:  Premature  upper  stage 
rocket  ignition,  explosion/fire  in  the  payload  bay, 
and  payload  shift  in  the  payload  bay. 

Premature  ignition  of  either  the  upper  stage 
stage  1  and/or  stage  2  motor  while  still  in  the  Or- 
biter bay  would  have  resulted  in  catastrophic 
failure  of  the  Orbiter.  Potential  causes  for 
premature  ignition  were  electrostatic  discharge, 
inadvertent  ignition  command  and  auto-ignition. 
Each  would  have  caused  a  rapid  increase  in  the 
Orbiter  payload  bay  temperature  and  pressure, 
and  would  have  been  immediately  followed  by 
structural  damage  to  the  payload  bay  doors.  The 
payload  bay  temperatures  remained  essentially 
constant,  and  the  Orbiter  photographic  and 
telemetry  data  indicated  the  payload  doors  re- 
mained closed  and  latched  from  lift  off  until  signal 
loss.27  Both  indications  verified  that  there  was  no 
ignition  of  the  IUS  solid  rocket  motors. 

An  IUS  component  explosion  or  fire  could 
have  damaged  critical  systems  in  the  Orbiter  by 
overheating  or  impact.  Five  sources  other  than 
an  upper  stage  motor  pre-ignition  were  identified 
as  potential  origins  of  a  fire  or  explosion  in  the 
payload  bay:  (1)  release  and  ignition  of  IUS 
hydrazine  from  the  reaction  control  system  tanks, 
(2)  fire  or  explosion  from  an  IUS  battery,  (3)  im- 
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pact  or  rupture  of  a  motor  case  and  subsequent 
ignition  of  exposed  propellant,  (4)  fire  of  electrical 
origin  due  to  a  short,  and  (5)  fire  or  inadvertent 
ignition  of  pyrotechnic  devices  due  to  radio  fre- 
quency radiation.  Thermal  measurements  in  the 
propellant  tank  and  in  components  adjacent  to 
the  propellant  tanks  indicated  no  abnormalities. 
Pre-launch  and  thermal  measurements  in  the  Or- 
biter  payload  bay  and  in  TDRS  near  the  reac- 
tion control  system  were  stable  throughout  the 
ascent  period.  A  fire  and/or  explosion  resulting 
in  shrapnel  from  an  IUS  battery  was  eliminated 
based  on  pre-launch  monitoring  of  open  circuit 
voltages  on  all  batteries,  except  the  support  equip- 
ment batteries.  Location  of  these  batteries  made 
the  potential  for  damage  to  critical  systems  very 
small  if  they  burned  or  exploded.  Motor  case  im- 
pact or  rupture  and  resulting  exposure  and  pro- 
pellant ignition  was  determined  improbable  be- 
cause batteries  and  reaction  control  system  burn- 
ing or  explosion  were  eliminated  by  flight  data 
analysis.  They  were  the  only  potential  sources  for 
IUS  heating  and  high  velocity  shrapnel.  Pro- 
pellant burning  was  not  indicated  by  payload  bay 
thermal  measurements.  Electrical  shorting  was 
eliminated  as  a  fire  source  in  the  payload  bay 
because  IUS  electrical  and  Orbiter  voltage 
monitors  were  normal  at  launch  and  during  STS 
51-L  ascent.  Fires  initiated  by  radio  frequency 
radiation  due  to  inadvertent  IUS,  TDRS,  or 
ground  emittance  were  eliminated  because  data 
showed  worst  case  radio  frequency  radiation  dur- 
ing ascent  was  less  than  ground-emitted  radia- 
tion to  the  payload  bay  during  pre-launch  check- 
out. The  ground-emitted  radiation  was  within 
specified  limits. 

IUS/TDRS  payload  shifting  or  breaking  free 
within  the  Orbiter  due  to  structural  failure  or 
premature  separation  was  investigated.  Such  a 
shift  could  have  resulted  in  severe  Orbiter  damage 
from  a  direct  impact,  or  could  have  induced  a 
significant  shift  in  the  Challenger  vehicle  center 
of  gravity  and  possibly  affected  flight  control.28 
Four  possible  faults  that  could  have  led  to  Or- 
biter damage  or  substantial  payload  shift  were 
considered:  IUS  stage  2/TDRS  separation,  IUS 
stage  1/stage  2  separation,  IUS/TDRS  separa- 
tion from  the  airborne  support  equipment  and 
IUS/airborne  support  equipment  separation  from 
Orbiter.  All  were  eliminated  because  dynamic 
response  data  conclusively  showed  that 
IUS/TDRS  responded  normally  until  the  final 
loss  of  data.  Further,  TDRS  data,  which  pass 
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through  the  IUS  stage  1/stage  2  and  support 
equipment,  were  continuous  until  data  loss,  verify- 
ing that  these  elements  did  not  separate. 

The  TDRS  spacecraft  weighs  approximately 
4,905  pounds  and  is  9.5  feet  in  diameter  and  19.5 
feet  long.  The  forward  1 1  feet  contain  six 
deployable  appendages,  two  solar  arrays,  one 
space-ground  link  antenna,  and  two  single  access 
antennas.  The  spacecraft  body  structure  consists 
of  a  payload  structure  and  a  spacecraft  structure. 
These  structures  house  the  tracking  and  telemetry 
and  command  subsystem,  power  subsystem,  ther- 
mal control  subsystem,  ordnance  subsystem, 
reaction  control  subsystem  and  attitude  control 
subsystem. 

Telemetry  data  were  transmitted  from  TDRS 
from  approximately  48  hours  prior  to  launch 
through  signal  loss.  The  telemetry  system  was 
functioning  properly,  and  the  data  indicated  that 
the  telemetry  processor  was  in  its  normal  opera- 
tional mode  and  all  power  supply  voltages  and 
calibration  voltages  were  normal.  There  were  no 
changes  through  the  countdown  to  the  time  of 
structural  breakup,  when  all  telemetry  abruptly 
halted.  The  telemetry  tracking  and  control  sub- 
systems command  and  tracking  elements  were  in- 
active during  the  countdown  through  ascent,  and 
no  changes  were  noted,  indicating  that  the  TDRS 
was  not  commanded  to  alter  its  launch 
configuration. 

The  TDRS  power  subsystem  had  a  total  of  138 
telemetry  indications.  These  were  the  main  data 
source  used  to  determine  the  power  subsystem 
activity.  Analyzing  this  telemetry  showed  all  sub- 
system elements  performed  normally. 

The  TDRS  thermal  control  subsystem  was 
designed  to  maintain  proper  temperatures 
primarily  by  passive  means.  Also,  there  is  a  ther- 
mostatically controlled  heater  system  to  ensure 
minimum  required  temperatures  are  maintain- 
ed. The  thermal  subsystem  was  monitored  by  82 
configuration  status  indicators  and  137  analog 
temperature  channels.  This  telemetry  showed 
that  the  TDRS  remained  in  its  normal  thermal 
configuration  and  experienced  normal 
temperatures  until  signal  loss. 

No  data  indicated  that  the  IUS  separated  from 
TDRS,  that  any  deployable  appendage  ordnance 
had  been  fired  or  that  any  appendage  motion  had 
begun. 

The  TDRS  reaction  control  system  was  inac- 
tive at  launch  and  required  an  IUS  command  and 
two  ground  commands  to  activate  any  propellant. 


Telemetry  indicated  no  valve  actuation,  changes 
in  tank  pressures  or  temperatures,  or  propellant 
line  temperature  violations.  Further,  there  was 
no  telemetry  that  would  suggest  a  hydrazine 
leakage  or  abnormality  and  no  indications  that 
the  TDRS  reaction  control  system  contributed 
to  the  accident. 

During  the  launch  phase,  the  attitude  control 
subsystem  was  disabled  except  for  the  gyros  and 
associated  electronics  necessary  to  provide  the 
telemetry.  All  telemetry  parameters  reflecting  at- 
titude control  subsystem  configuration  remain- 
ed normal  and  unchanged  during  the  STS  51-L 
pre-launch  and  post-launch  periods. 

The  TDRS  was  mounted  in  a  cantilevered 
fashion  to  the  IUS  by  an  adapter  ring  that  pro- 
vided structural,  communications  and  power  in- 
terfaces. Structural  integrity  loss  indications 
would  have  been  observed  by  interruptions  in 
telemetry  or  electrical  power.  TDRS  telemetry 
during  the  launch  phase  was  transmitted  by  elec- 
trical cable  to  the  IUS  and  interleaved  with  up- 
per stage  data.  If  separation  had  occurred  at 
either  the  TDRS/IUS  interface  or  the  IUS/sup- 
port  equipment  interface,  TDRS  data  would  have 
stopped.  There  was  no  abnormal  telemetry  until 
signal  loss  of  all  vehicle  telemetry.  TDRS  also 
received  power  from  the  Shuttle  via  the  IUS 
through  the  same  interfaces.  There  were  no  in- 
dications of  TDRS  batteries  coming  on  line.  This 
indicates  that  structural  integrity  at  the  TDRS 
and  IUS  interfaces  was  maintained  until  the 
structural  breakup.  Additionally,  an  inspection 
of  the  recovered  debris  gives  the  following  indica- 
tions that  the  TDRS/IUS  remained  intact  until 
the  structural  breakup.  First,  the  separation  bank 
lanyards  frayed  at  the  end  where  they  attached 
to  the  band,  indicating  that  the  spacecraft  was 
pulled  forcefully  from  the  adapter.  Second,  the 
V-groove  ring  structure  at  the  top  of  the  adapter 
was  torn  from  its  riveted  connection  to  the 
adapter,  indicating  that  a  strong  shear  existed  be- 
tween the  spacecraft  and  IUS  which  would  only 
be  generated  if  the  two  were  still  attached.  Final- 
ly, the  adapter  base  was  torn  where  it  attached 
to  the  IUS,  again  indicating  high  tension  and 
shear  forces.  There  were  no  indications  from 
telemetry  or  recovered  debris  that  showed  that 
the  structural  integrity  of  the  satellite  or  the 
satellite/stage  interface  had  been  compromised. 

The  TDRS  records  at  Kennedy  were  review- 
ed for  technical  correctness  and  to  verify  that  no 
open  safety  related  issues  existed.  There  were  no 


findings  that  revealed  unsafe  conditions  or  that 
any  safety  requirements  had  been  violated  or 
compromised. 

A  review  and  assessment  of  Spartan  Halley 
performance  was  conducted  to  establish  any 
possible  contributions  to  the  STS  51-L  accident. 
The  Spartan  Halley  was  unpowered  except  for 
the  release/engage  mechanism  latch  monitor.  Its 
electrical  current  was  in  the  order  of  milliamps 
and  the  telemetry  records  obtained  from  the  Or- 
biter  indicated  that  the  latches  were  in  the  prop- 
er configuration  and  thus  Spartan  Halley  re- 
mained firmly  attached  during  flight.  In  addition, 
the  TDRS  spacecraft  data  indicated  there  was  no 
interaction  from  Spartan.  Therefore,  the  Spar- 
tan Halley  and  its  support  structure  remained  in- 
tact. The  payload  bay  temperature  in  the  vicini- 
ty of  Spartan  was  55  degrees  Fahrenheit  in- 
dicating no  abnormal  thermal  conditions. 

As  a  result  of  detailed  analyses  of  the  STS  51-L 
Orbiter.  the  payload  flight  data,  payload 
recovered  hardware,  flight  film,  available  payload 
pre-launch  data  and  applicable  hardware  process- 
ing documentation,  the  Commission  concluded  that 
the  payload  did  not  cause  or  contribute  to  the  cause  of 
the  accident. 


Solid  Rocket  Booster 

The  Solid  Rocket  Booster  comprises  seven  sub- 
systems: structures,  thrust  vector  control,  range 
safety,  separation,  electrical  and  instrumentation, 
recovery,  and  the  Solid  Rocket  Motor. 

All  recovered  Solid  Rocket  Booster  pieces  were 
visually  examined,  and  selected  areas  were  ex- 
tracted for  chemical  and  metallurgical  analysis. 

The  exterior  surfaces  of  the  Solid  Rocket 
Boosters  are  normally  protected  from  corrosion 
by  an  epoxy  resin  compound.  There  were  several 
small  areas  where  this  protective  coating  was 
gouged  or  missing  on  the  pieces  recovered  and, 
as  a  result,  the  exposed  metallic  surfaces  in  the 
areas  were  corroded.  The  damage  to  the  protec- 
tive coating  was  most  likely  the  result  of  detona- 
tion of  the  linear  shaped  charges  and  water  im- 
pact. There  was  no  obvious  evidence  of  major  ex- 
ternal flame  impingement  or  molten  metal  found 
on  any  of  the  pieces  recovered.  All  fracture  sur- 
faces exhibited  either  the  characteristic  markings 
of  rapid  tensile  overload,  a  complete  bending 
failure  due  to  overload,  or  a  separation  fracture 
due  to  the  detonation  of  the  linear  shaped  charges. 
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Other  pieces  of  the  right  Solid  Rocket  Motor  aft 
field  joint  showed  extensive  burn  damage, 
centered  at  the  307  degree  position. 

Most  of  the  Solid  Rocket  Motor  case  material 
recovered  contained  pieces  of  residual  unburned 
propellant  still  attached  to  the  inner  lining  of  the 
case  structure.29  The  severed  propellant  edges 
were  sharp,  with  no  unusual  burn  patterns.  Pro- 
pellant recovered  with  a  forward  segment  of  the 
booster  exhibited  the  star  pattern  associated  with 
the  receding  shape  of  the  propellant  at  the  front 
end  of  the  Solid  Rocket  Motor.  There  was  no 
evidence  found  of  propellant  grain  cracking  or 
debonding  on  the  pieces  recovered.  Casting  flow 
lines  could  be  distinguished  on  the  propellant  sur- 
faces in  several  areas.  This  is  a  normal  occurrence 
due  to  minor  differences  in  the  propellant  cast 
during  the  installation  of  the  propellant  in  the 
motor  case  structure. 

Hardness  tests  of  each  piece  of  the  steel  casing 
material  were  taken  before  the  propellant  was 
burned  from  the  piece.  All  of  the  tests  showed 
normal  hardness  values. 

One  of  the  pieces  of  casing  showed  evidence 


of  O-ring  seal  tracks  on  the  tang  of  the  field  joint. 
The  tracks  were  cleaned  with  hexane  to  remove 
the  grease  preservative  that  had  been  applied  after 
recovery  of  the  piece,  and  samples  of  the  track 
material  were  removed  for  analysis.  Chemical 
analysis  of  the  track  material  showed  that  the 
tracks  were  not  composed  of  degraded  O-ring  seal 
material. 

The  possible  Solid  Rocket  Booster  faults  or 
failures  assessed  were:  structural  overload.  Solid 
Rocket  Motor  pressure  integrity  violation,  and 
premature  linear  shaped  charge  detonation. 

Reconstructed  lift  off  and  flight  loads  were 
compared  with  design  loads  to  determine  if  a 
structural  failure  may  have  caused  the  accident. 
The  STS  51-L  loads  were  within  the  bounds  of 
design  and  capability  and  were  not  a  factor. 
Photographic  and  video  imagery  confirmed  that 
both  Solid  Rocket  Boosters  remained  structural- 
ly intact  until  the  time  of  the  explosion  except  for 
the  leak  observed  on  right  Solid  Rocket  Motor. 

The  possibility  that  the  range  safety  system 
prematurely  operated,  detonating  the  linear 
shaped   charges   was    investigated.    The   linear 
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Figure  8 

Solid  Rocket  Booster  drawing  at  top  is  exploded  in  lower 
drawings  to  show  motor  segments  and  other  elements  at  for- 
ward and  aft  ends  of  booster. 
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Reconstructed  STS  51 -L  Loads  Compared  to  Measure  and  Design  Loads 

Figure9 

Aft  ET/SRB 
Struts 

Measured  Net  Load 

Recon- 
structed 

Design 
Loads 

STS  1               STS  2              STS  3              STS  5 
(LB,x103)        (LB,x103)        (LB,x10~3)        (LB,x10~3) 

-86                 -93                 -78                 -55 

STS  6 

(LB,x10'3) 

-76 

STS  7 

(LB,x103) 

-76 

STS51-L 
(LB,x10'3) 

-139 

(LB,x10'3) 
-306 

P8 

P9 

142                   126                   141                   120 

122 

120 

138 

393 

P10 

-150               -128               -105                 -94 

-105 

-116 

-108 

-306 

P11 

-93                 -75                 -71                  -58 

-85 

-71 

-141 

-306 

P12* 

137                   138                   124                   116 

116 

121 

140 

393 

P13 

-172               -108               -111                -111 

-102 

-106 

-94 

-306 

*  Strut  Nearest  Point  of  Failure 
LB,  =  Pounds  Force 

Table  compares  External  Tank/Solid  Rocket  Booster  strut 
loads  for  first  seven  Shuttle  flights  with  those  for  the  mission 
51 -L  launch  and  the  strut  design  loads  for  the  vehicle. 


Aft  External  Tank/Solid  Rocket  Booster  Liftoff  Strut  Loads 


shaped  charges  were  photographically  observed 
to  destroy  both  Solid  Rocket  Boosters  at  110 
seconds  after  launch  when  commanded  to  do  so 
by  the  Range  Safety  Officer  and  therefore  could 
not  have  discharged  at  73  seconds  after  launch 
causing  the  accident.  The  possibilities  of  the  Solid 
Rocket  Boosters  separating  prematurely  from  the 
External  Tank,  the  nozzle  exit  cone  premature- 
ly separating  or  early  deployment  of  the  recovery 
system  were  examined.  Premature  activation  of 
the  separation  system  was  eliminated  as  a  cause 
of  failure  based  on  telemetry  that  showed  no 
separation  commands.  There  were  no  indications 
that  the  nozzle  exit  cone  separated.  The  recovery 
system  was  observed  photographically  to  activate 
only  after  the  Solid  Rocket  Boosters  had  exited 
the  explosion. 

In  addition  to  the  possible  faults  or  failures, 
STS  51-L  Solid  Rocket  Booster  hardware 
manufacturing  records  were  examined  in  detail 
to  identify  and  evaluate  any  deviations  from  the 
design,  any  handling  abnormalities  or  incidents, 
any  material  usage  issues,  and/or  other  indica- 
tion of  problems  that  might  have  importance  in 
the  investigation.  Based  on  these  observations,  the 
Commission  concluded  that  the  left  Solid  Rocket  Booster, 
and  all  components  of  the  right  Solid  Rocket  Booster,  ex- 
cept the  right  Solid  Rocket  Motor,  did  not  contribute  to 
or  cause  the  accident. 

The  Right  Solid  Rocket  Motor 

As  the  investigation  progressed,  elements 
assessed  as  being  improbable  contributors  to  the 
accident  were  eliminated  from  further  considera- 


tion. This  process  of  elimination  brought  focus 
to  the  right  Solid  Rocket  Motor.  As  a  result,  four 
areas  related  to  the  functioning  of  that  motor 
received  detailed  analysis  to  determine  their  part 
in  the  accident: 

■  Structural  Loads  Evaluation 

■  Failure  of  the  Case  Wall  (Case  Membrane) 

■  Propellant  Anomalies 

■  Loss  of  the  Pressure  Seal  at  the  Case  Joint 

Where  appropriate,  the  investigation  considered 
the  potential  for  interaction  between  the  areas. 


Structural  Loads  Evaluation 

Structural  loads  for  all  STS  51-L  launch  and 
flight  phases  were  reconstructed  using  test- 
verified  models  to  determine  if  any  loading  con- 
dition exceeded  design  limits. 

Seconds  prior  to  lift  off,  the  Space  Shuttle  Main 
Engines  start  while  the  Solid  Rocket  Boosters  are 
still  bolted  to  the  launch  pad.  The  resultant  thrust 
loads  on  the  Solid  Rocket  Boosters  prior  to  lift 
off  were  derived  in  two  ways:  (1)  through  strain 
gauges  on  the  hold-down  posts,  and  (2)  from 
photographic  coverage  of  Solid  Rocket  Booster 
and  External  Tank  tip  deflections.  These  show- 
ed that  the  hold-down  post  strain  data  were  within 
design  limits.  The  Solid  Rocket  Booster  tip  deflec- 
tion ("twang")  was  about  four  inches  less  than  seen 
on  a  previous  flight,  STS-6,  which  carried  the 
same  general  payload  weight  and  distribution  as 
STS  51-L.  The  period  of  oscillation  was  normal. 
These  data  indicate  that  the  Space  Shuttle  Main 
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Shuttle  Strut  Identification 


Forward  External  Tank/Orbiter  attachment  Aft  External  Tank/Orbiter  attachment 


Forward  External  Tank/ 
Solid  Rocket  Booster 
area  of  attachment 


Aft  External  Tank/ 
Solid  Rocket  Booster 
area  of  attachment 


'Nearest  to 
Point  of  Failure 


Figure  10 

Drawing  of  transparent  External  Tank,  with  right  Solid 
Rocket  Booster  on  far  side,  shows  location  of  struts 
measured  in  table  of  strut  loads  (Figure  9) 


Engine  thrust  buildup,  the  resulting  forces  and 
moments,  vehicle  and  pad  stiffness,  and 
clearances  were  as  expected.  The  resultant  total 
bending  moment  experienced  by  STS  51-L  was 
291  x  106  inch-pounds,  which  is  within  the 
design  allowable  limit  of  347  x   106  inch-pounds. 

The  STS  51-L  lift  offloads  were  compared  to 
design  loads  and  flight  measured  loads  for  STS-1 
through  STS-7  (Figure  9).  The  Shuttle  strut  iden- 
tification is  shown  in  Figure  10.  The  loads 
measured  on  the  struts  are  good  indicators  of 
stress  since  ail  loads  between  Shuttle  elements  are 
carried  through  the  struts.  The  STS  51-L  lift  off 
loads  were  within  the  design  limit. 

Because  the  Solid  Rocket  Motor  field  joints 
were  the  major  concern,  the  reconstructed  joint 
loads  were  compared  to  design  loads.  Most  of  the 
joint  load  is  due  to  the  booster's  internal  pressure, 
but  external  loads  and  the  effects  of  inertia 
(dynamics)  also  contribute.  The  Solid  Rocket 
Motor  field  joint  axial  tension  loads  at  lift  off  were 
within  the  design  load  limit  (17.2  x  106  pounds). 
The  highest  load  occurred  at  the  forward  field 
joint,  15.2  x    106  pounds.  The  mid-joint  load  was 


13.9  x  106  pounds,  while  the  aft  joint  showed 
13.8    x    106  pounds  load. 

Loads  were  constructed  for  all  in-flight  events, 
including  the  roll  maneuver  and  the  region  of 
maximum  dynamic  pressure.  A  representative 
measure  of  these  loads  is  the  product  of  dynamic 
pressure  (q)  and  the  angle  of  attack  (a).  Since  the 
Shuttle  is  designed  to  climb  out  at  a  negative 
angle  of  attack,  the  product  is  a  negative  number. 
The  loads  in  the  q  x  ex  pitch  plane  are  shown 
in  Figure  1 1 .  Although  the  q  x  a  variations  in 
loads  due  to  wind  shear  were  larger  than  ex- 
pected, they  were  well  within  the  design  limit 
loads. 

The  Solid  Rocket  Motor  field  joint  axial  ten- 
sion loads  were  substantially  lower  at  maximum 
dynamic  pressure  than  at  lift  off:  11.6  x  106 
pounds  for  the  forward  field  joint  and  10.6  x  106 
pounds  for  the  aft  field  joint.  Compared  to  the 
internal  pressure  loads,  the  dynamic  variations 
due  to  wind  shear  were  small  — about  '/is  those 
of  the  pressure  loads.  These  loads  were  well  below 
the  design  limit  loads  and  were  not  considered  the  cause 
of  the  accident. 
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Figure  1 1 

The  loads  in  the  pitch  plane  are  shown  by  the  solid  line 
marked  "STS  51 -L  RECONST."  The  curve  "STS  51 -L 
PREDICTED"  give  the  loads  expected  before  the  flight.  The 
dashed  lines  show  the  limit  of  experience  from  STS-1  through 
61 -B.  The  present  design  limits  are  the  two  lines  marked  "OV 


72 


74 


75 


102/099  WING  LIMIT"  above,  and  "ET/SRB  CAP.  ASSESS- 
MENT LIMIT  LINE"  below.  (After  STS-6,  the  wing  was 
strengthened. The  previous  design  limits  were "  ET/SRB  IVBC  2 
DESIGN  ENVELOPE"  below,  and  a  curve  in  the  positive 
region  of  q  x  a  above) 


Assumed  Inhibitor  Flaw 


Figure  12 

Sketch  shows  location  of  assumed   inhibitor  flaw  used 

eliminating  such  a  problem  as  a  possible  cause. 


Case  Membrane  Failure 

The  case  membrane  is  the  half-inch  thick  steel 
wall  of  the  rocket  between  the  joints.  The 
possibility  that  the  failure  was  initiated  by 
anomalies  associated  with  the  case  membrane  was 
evaluated  by  analysis  of  design  and  test  criteria. 
Potential  failure  modes  were  constrained  by  the 
following  flight  data  and  photographic  observa- 
tions: 

( 1 )  A  burn  through  the  membrane  would  have 
to  occur  at  or  near  the  aft  field  joint. 

(2)  The  failure  could  have  little  or  no  influence 
on  motor  internal  pressure  since  no  devia- 
tion in  pressure  occurred  prior  to  60 
seconds. 

(3)  The  failure  must  cause  a  burn  through  the 
membrane  in  58  seconds. 

The  hypothesis  of  a  membrane  failure  requires 
that  the  initial  smoke  observed  at  0.678  seconds 
was  an  independent  occurrence.  It  is  an  unlikely 
hypothesis  for  initiation  of  the  accident.  Fracture 
mechanics  analysis  indicates  that  a  hole  in  the 
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Cutaway  view  of  the  Solid  Rocket  Booster  showing  Solid 
Rocket  Motor  propellant  and  aft  field  joint 
Figure  13 


Nozzle  and  Thrust  Vector 
Control  System 


4  Separation  Motors 
22.050  lb  thrust  each 


Solid  Rocket  Motor 
Aft  Field  Joint 


Main  Parachutes  (3) 

4  Separation  Motors 
22,050  lb  thrust  each 


Drogue  Chute 


Solid  Propellant 


J'3.8m(12.4ft) 

Outside  Diameter 
v 


Aft  Skirt  and 
Launch  Support 


Booster-External  Tank  Attachment 
Ring,  Aft  Avionics  and  Sway  Braces 


Dimensions 


Length 149.16  ft  (45.46  m) 

Diameter   12.17  ft    (3.70  m) 


\  Forward 
Skirt 

Frustum 


SRB-External  Tank 
Thrust  Attachment 

Rate  Gyro  Assemblies  (3), 
Separation  Avionics,  Operational 
Flight  Instrumentation,  Recovery 
Avionics,  and  Range  Safety  System 


Nose  Fairing 


case  larger  than  one  inch  would  cause  the  entire 
case  to  rupture  in  a  few  milliseconds.  This  would 
give  rise  to  the  appearance  of  a  large  longitudinal 
flame,  an  event  that  is  contrary  to  the  flight  films. 

Evaluation  of  potential  insulation  or  inhibitor 
(see  Figure  12)  flaws  against  the  three  criteria 
above  resulted  in  elimination  of  all  candidates  ex- 
cept a  defect  in  the  forward-facing  inhibitor.  This 
potential  failure  mode  was  evaluated  by  assum- 
ing a  1 -inch-diameter  hole  in  the  inhibitor. 
Analysis  indicated  that  the  change  in  motor  in- 
ternal pressure  resulting  from  this  failure  would 
probably  not  be  detected.  However,  an  erosion 
rate  substantially  higher  than  the  observed  values 
would  be  required  to  burn  through  the  membrane 
b)  58  seconds.  In  addition,  the  assumed  flaw  is 
unlikely  since  the  inhibitor  is  constructed  by 
vulcanizing  eight  individual  plies  of  the  material. 
Subsequent  damage  of  the  magnitude  required 
is  improbable  and  would  be  easily  detected. 

A  ic\  ic\\  of  the  segment  inspection  and  of  proof 
tests  was  conducted.  Prior  to  vehicle  assemblv. 
each  segment  was  pressurized  to  112  percent  of 
the  maximum  design  operational  pressure.  A 
magnetic  particle  inspection  of  each  membrane 
was  then  conducted.  These  procedures  are 
designed  to  screen  critical  flaws,  and  are  capable 
of  detecting  cracks  greater  than  0. 1  inches.  Frac- 


ture mechanics  analysis  indicates  that  a  flaw  0. 1 
inch  long  and  0.050  inch  deep  would  grow  to  only 
0.122  inches  long  and  0.061  inches  deep  in  80 
uses  of  the  segment.  This  flaw  would  be  less  than 
the  critical  size  required  to  cause  case  rupture. 
Furthermore,  as  noted  previously,  a  failure 
resulting  in  a  case  rupture  is  not  consistent  with 
photographic  observations. 

Subsequent  to  these  evaluations,  sections  of  the 
right  Solid  Rocket  Motor  case  containing  holes 
burned  through  in  the  area  of  the  aft  field  joint 
were  recovered.  Assessments  of  the  sections  do  not  sup- 
port a  failure  that  started  in  the  membrane  and  progress- 
ed slowly  to  the  joint;  or  one  that  started  in  the  mem- 
brane and  grew  rapidly  the  length  of  the  Solid  Rocket 
Motor  segment. 

Propellant 

An  examination  of  propellant  characteristics 
and  flight  data  was  accomplished  to  determine 
if  any  anomalous  conditions  were  present  in  the 
STS  51-L  right  Solid  Rocket  Motor.  Propellant 
cracking  and  propellant  mean  bulk  temperatures 
were  evaluated. 

Historically,  the  propellant  family  used  in  the 
Solid  Rocket  Motor  (TP-H1148)  has  exhibited 
good  mechanical  properties  and  an  absence  of 
grain  structural  problems.  Should  a  crack  occur, 
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however,  the  effects  would  be  evident  by  changes 
in  chamber  pressure.  Shortly  after  lift  off,  the  STS 
51-L  right  Solid  Rocket  Motor  chamber  pressure 
was  22  pounds  per  square  inch  higher  than  that 
of  the  left  solid.  This  would  correlate  to  a 
postulated  radial  crack  through  the  grain  span- 
ning a  90-degree,  pie-shaped  wedge  of  the  solid. 
However,  with  a  crack  of  this  nature,  the 
chamber  pressure  would  have  remained  high  for 
approximately  60  seconds.  Telemetry  shows  that 
the  right  Solid  Rocket  Motor  chamber  pressure 
did  not  remain  high  past  20-24  seconds  and, 
therefore,  the  existence  of  a  propellant  crack  was 
ruled  out. 

Propellant  mean  bulk  temperature  calculations 
were  made  using  the  ambient  temperature  over 
the  two-week  period  prior  to  launch.  The  lowest 
bulk  temperature  experienced  was  57  degrees 
Fahrenheit  on  the  day  of  the  launch.  This  was 
17  degrees  Fahrenheit  above  the  minimum 
specified. 

Based  on  this  assessment  and  subscale  lot- 
acceptance  motor-firing  evaluations,  it  is  im- 
probable that  propellant  anomalies  contributed  to  the  STS 
51-L  accident. 

Joint  Seal  Failure 

Enhanced  photographic  and  computer-graphic 
positioning  determined  that  the  flame  from  the 
right  Solid  Rocket  Booster  near  the  aft  field  joint 
emanated  at  about  the  305-degree  circumferen- 
tial position.  The  smoke  at  lift  off  appeared  in 
the  same  general  location.  Thus,  early  in  the  in- 
vestigation the  right  Solid  Rocket  Booster  aft  field 
joint  seal  became  the  prime  failure  suspect.  This 
supposition  was  confirmed  when  the  Salvage 
Team  recovered  portions  of  both  sides  of  the  aft 
joint  containing  large  holes  extending  from  291 
degrees  to  318  degrees.  Several  possible  causes 
could  have  resulted  in  this  failure.  These  possi- 
ble causes  are  treated  in  the  following  paragraphs 
of  this  report. 

During  stacking  operations  at  the  launch  site, 
four  segments  are  assembled  to  form  the  Solid 
Rocket  Motor.  The  resulting  joints  are  referred 
to  as  field  joints,  located  as  depicted  in  Figures 
8  and  13.  Joint  sealing  is  provided  by  two  rub- 
ber O-rings  with  diameters  of  0.280  inches 
(  +  0.005,  -0.003),  which  are  installed,  as  re- 
ceived from  Morton  Thiokol,  during  motor 
assembly.  O-ring  static  compression  during  and 
after  assembly  is  dictated  by  the  width  of  the  gap 


between  the  tang  and  the  inside  leg  of  the  clevis. 
This  gap  between  the  tang  and  clevis  at  any  loca- 
tion after  assembly  is  influenced  by  the  size  and 
shape  (concentricity)  of  the  segments  as  well  as 
the  loads  on  the  segments.  Zinc  chromate  putty 
is  applied  to  the  composition  rubber  (NBR)  in- 
sulation face  prior  to  assembly.  In  the  assembled 
configuration  the  putty  was  intended  to  act  as  a 
thermal  barrier  to  prevent  direct  contact  of  com- 
bustion gas  with  the  O-rings.  It  was  also  intended 
that  the  O-rings  be  actuated  and  sealed  by  com- 
bustion gas  pressure  displacing  the  putty  in  the 
space  between  the  motor  segments  (Figure  14). 
The  displacement  of  the  putty  would  act  like  a 
piston  and  compress  the  air  ahead  of  the  primary 
O-ring,  and  force  it  into  the  gap  between  the  tang 
and  clevis.  This  process  is  known  as  pressure  ac- 
tuation of  the  O-ring  seal.  This  pressure  actuated 
sealing  is  required  to  occur  very  early  during  the 
Solid  Rocket  Motor  ignition  transient,  because 
the  gap  between  the  tang  and  clevis  increases  as 
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Grease  Bead 

Pin 
Retainer  Clip 
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Figure  14 

Solid  Rocket  Motor  cross  section  shows  positions  of  tang. 

clevis  and  O-rings.  Putty  lines  the  joint  on  the  side  toward  the 

propellant. 
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pressure  loads  are  applied  to  the  joint  during 

ignition.  Should  pressure  actuation  be  delayed  to 
the  extent  that  the  gap  has  opened  considerably, 
the  possibility  exists  that  the  rocket's  combustion 
gases  will  blow  by  the  O-ring  and  damage  or 
destroy  the  seals.  The  principal  factor  influenc- 
ing the  size  of  the  gap  opening  is  motor  pressure; 
but,  gap  opening  is  also  influenced  by  external 
loads  and  other  joint  dynamics.  The  investiga- 
tion has  shown  that  the  joint  sealing  performance 
is  sensitive  to  the  following  factors,  either  in- 
dependently or  in  combination: 

(a)  Damage  to  the  joints/seals  or  generation 
of  contaminants  as  joints  are  assembled  as 
influenced  by: 

(1)  Manufacturing  tolerances. 

(2)  Out  of  round  due  to  handling. 

(3)  Effects  of  reuse. 

(b)  Tang/clevis  gap  opening  due  to  motor 
pressure  and  other  loads. 

(c)  Static  O-ring  compression. 

(d)  Joint  temperature  as  it  affects  O-ring 
response  under  dynamic  conditions 
(resiliency)  and  hardness. 

(e)  Joint  temperature  as  it  relates  to  forming 
ice  from  water  intrusion  in  the  joint. 

(f)  Putty  performance  effects  on: 

(1)  O-ring  pressure  actuation  timing. 

(2)  O-ring  erosion. 

The  sensitivity  of  the  O-ring  sealing  perform- 
ance to  these  factors  has  been  investigated  in  ex- 
tensive tests  and  analyses.  The  sensitivity  to  each 
factor  was  evaluated  independently  and  in  ap- 
propriate combinations  to  assess  the  potential  to 
cause  or  contribute  to  the  51-L  aft  field  joint 
failure.  Most  of  the  testing  was  done  on  either 
laboratory  or  subscale  equipment.  In  many  cases, 
the  data  from  these  tests  are  considered  to  be 
directly  applicable  to  the  seal  performance  in  full 
scale.  However,  in  some  cases  there  is  con- 
siderable uncertainty  in  extrapolating  the  data  to 
full-scale  seal  performance.  Where  such  is  the 
case,  it  is  noted  in  the  following  discussions. 

Assembly  Damage  Contamination 

It  is  possible  that  the  assembly  operation  could 
influence  joint  sealing  performance  by  damaging 
the  O-rings  or  by  generating  contamination.  The 
shapes  of  the  solid  rocket  segments  which  include 
the  tang  and  clevis,  are  not  perfect  <  ircles  because 
of  dimensional  tolerances,  stresses,  distortions 


SRB  Joint  Tang  Clevis  Interference 


Premate  Measurements  of  the  Tang  and  Clevis 
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Measurements  Made  on  Both  Segments 
(Tang  &  Clevis)  at  Six  Locations 

DT  =  Outside  Diameter  of  Tang 

Dc  =  Inside  Diameter  of 
Clevis  Outer  Leg 


Figure  15 

Sketch  shows  how  diameters  of  tang  and  clevis  are  measured 

to  assure  proper  fit  of  two  Solid  Rocket  Motor  segments. 
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from  previous  use,  and  the  effects  of  shipping  and 
handling.  The  most  important  effect  is  from  the 
load  of  propellant,  a  plastic  and  rubbery  material, 
which  can  take  a  set  that  relaxes  very  slowly.  For 
example,  since  the  segments  are  shipped  in  a 
horizontal  position  on  railroad  cars,  their  weight 
can  make  them  somewhat  elliptical  —  a  shape  they 
can  maintain  for  some  time.  At  assembly,  after 
the  lower  segment  (with  the  clevis  on  top)  is 
placed  vertically,  the  tang  of  the  next  segment  is 
lowered  into  it.  To  make  the  fit  easier,  the  up- 
per segment  is  purposely  reshaped  by  connecting 
the  lifting  crane  in  an  appropriate  position  and, 
on  occasion  (51-L  was  one  of  these),  directly 
squeezing  the  tang  section  with  a  special  tool.  To 
monitor  the  fit,  the  diameters  of  the  clevis,  Dc:, 
and  the  tang,  DT  (Figure  15)  are  measured  at 
six  positions  30  degrees  apart,  and  difference  of 
these  measurements  (DT  -  Dc)  are  noted. 
When  these  differences  are  such  that  the  tang  en- 
croaches somewhat  into  the  outer  clevis,  slanted 
edges  (chamfers)  permit  the  pieces  to  slide 
together.  If  the  difference  is  too  great,  flat  areas 
of  the  tang  meet  flat  areas  of  the  clevis.  What  real- 
ly counts,  of  course,  are  differences  of  radii,  which 
diameter  measurements  alone  do  not  determine, 
for  one  does  not  know  during  the  assembly  how 
far  off  the  centers  are.  This  is  a  circumstance  to 
be  avoided,  but  one  that  can  be  detected  during 
assembly.  Experience  has  shown  that  a  diameter 
difference  of  less  than  +0.25  inches  usually  per- 
mits assembly  without  a  flat-on-flat  condition  aris- 
ing. A  negative  diameter  difference  means  the 
tang  encroaches  on  the  inside  of  the  clevis.  The 
possibility  was  noted  that  contaminants  from 
sliding  metal  and  direct  O-ring  pinching  might 
occur  if  this  overlap  is  large.  If  it  is  too  great,  a 
flat-on-flat  condition  can  arise  inside  the  joint 
where  it  is  very  difficult  to  see.  These  dimensions 
shift  as  the  pieces  slide  together  and  they  change 
further  as  the  propellant  stresses  relax  during  the 
period  between  assembly  and  launch.  Therefore, 
a  condition  such  as  that  which  occurred  during 
assembly  of  the  aft  segment  for  flight  51-L, 
wherein  the  maximum  interference  between  tang 
and  clevis  at  the  O-rings  was  at  approximately 
300  degrees,  may  or  may  not  have  persisted  un- 
til launch  — seven  weeks  after  assembly. 

The  O-rings  are  heavily  greased  to  prevent 
damage.  This  grease  adds  another  element  of 
uncertainty  to  the  configuration  and  action  of  the 
seal  under  pressurization,  especially  at  low 
temperatures. 


Testing  was  conducted  during  the  investiga- 
tion to  evaluate  the  potential  for  assembly  damage 
and  contaminant  generation,  and  its  effect  on  seal 
performance.  A  sub-scale  section  of  a  field  joint 
was  configured  in  a  test  fixture  and  simulated 
assembly  operations  were  conducted.  This  sec- 
tion was  much  stiffer  than  the  full-scale  booster 
segments  and  did  not  fully  simulate  actual 
assembly  conditions.  However,  under  these  test 
circumstances,  metal  slivers  were  generated  dur- 
ing situations  wherein  the  tang  flat  overlapped 
the  flat  end  of  the  clevis  leg  by  0.005  to  0.010 
inches.  The  metal  slivers  in  turn  were  carried  into 
the  joint  and  deposited  on  and  around  the  CD- 
rings .  A  second  finding  from  this  test  series  was 
that  the  O-ring  section  increased  in  length  as  the 
tang  entered  the  clevis  and  compressed  the  O- 
ring  diameter.  The  implication  of  this  finding  is 
that  canted  tang  entry  in  a  full  diameter  segment, 
while  unlikely,  could  chase  the  O-ring  around  the 
circumference,  resulting  in  gathering  (bulging 
from  the  groove)  on  the  opposite  side.  This  could 
make  the  O-ring  more  vulnerable  to  damage. 
There  is  no  known  experience  of  such  bulging 
during  previous  assemblies. 

To  understand  the  effects  of  potential  con- 
taminants on  sealing  performance,  tests  were  con- 
ducted employing  metal  contaminants  simulating 
those  generated  in  the  segment  assembly  tests. 
The  tests  were  to  determine  if  joints  with  metal 
shavings  positioned  between  the  O-ring  and  seal- 
ing surface  could  pass  a  static  leak  check  but  fail 
under  dynamic  conditions.  The  contaminants 
that  passed  the  50  pounds  per  square  inch  leak 
check  were  between  0.001  and  0.003  inches  thick. 
Testing  to  determine  seal  performance  under 
dynamic  conditions  with  these  representative  con- 
taminations is  not  complete.  However,  the 
possibility  cannot  be  dismissed  that  contamina- 
tion generated  under  some  assembly  conditions 
could  pass  a  leak  check  and  yet  cause  the  seal  to 
leak  under  dynamic  conditions. 

A  second  concern  was  structural  damage  to  the 
clevis  due  to  abnormal  loading  during  assembly. 
An  analysis  was  made  to  determine  the  deflec- 
tions and  stresses  experienced  during  assembly 
of  the  right  Solid  Rocket  Motor  aft  center  seg- 
ment to  the  aft  segment.  These  stresses  were  then 
used  in  a  fracture  mechanics  analysis  of  the  O- 
ring  groove  to  detemine  the  maximum  flaw  size 
that  would  not  fail  under  the  51-L  case  segment 
life  cycle  history.  Included  in  this  analysis  was 
the  single  point  load  needed  to  deflect  a  suspended 
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segment  to  the  side  by  0.200  inches,  and  the  max- 
imum stress  on  the  case  clevis  that  this  causes. 
The  analysis  further  addressed  a  condition  that 
has  been  encountered,  where  the  tang  sits  on  top 
of  the  inner  clevis  leg  on  one  side  and  slips  down 
into  the  clevis  groove  on  the  opposite  side. 

The  result  of  this  analysis  is  that  the  stresses 
induced  during  the  operation  were  low  and  would 
not  have  resulted  in  hardware  damage.  Also,  the 
stresses  would  have  resulted  in  significant  growth 
of  an  undetected  flaw,  which  then  would  be  de- 
tectable by  inspection  on  its  next  use. 


Gap  Opening 

The  gap  to  be  sealed  between  the  tang  and  the 
inside  leg  of  the  clevis  opens  as  the  combustion 
gas  pressure  rises.  This  gap  opening  was 
calculated  as  a  function  of  pressure  and  time  by 
an  analysis  that  was  calibrated  to  joint  deflections 
measured  on  a  structural  test  article.  The  analysis 
extended  the  results  beyond  test  calibration  con- 
ditions to  include  propellant  effects  and  external 
loads.  The  initial  static  gap  dimensions  combined 

Pressurized  Joint  Deflection 


C 


o 

> 

LU 


\J 


Pressurized  Joint 
(Exaggerated) 


Unpressurized  Joint 


Figure  16 

Drawings  show  how  tang/clevis  joint  deflects  during 
pressunzation  to  open  gap  at  location  of  O-nng  slots  Inside  of 
motor  case  and  propellant  are  to  left  in  sketches 


with  the  time  history  of  the  gap  opening  deter- 
mined the  minimum  and  maximum  gap  condi- 
tions used  for  testing  the  capability  of  the  O-rings 
to  seal. 

The  joint  deflection  analysis  established  time 
histories  for  gap  openings  for  primary  and  sec- 
ondary O-rings  for  all  field  joints.  For  the  aft  field 
joints  these  data  indicate  gap  opening  increases 
of  approximately  0.029  inches  and  0.017  inches 
for  the  primary  and  secondary  O-rings  respec- 
tively. These  values  were  used  for  sub-scale 
dynamic  tests.  Due  to  differences  in  motor 
pressure  and  loads,  the  gap  opening  increases  for 
forward  field  joints  are  approximately  0.008 
inches  greater  than  for  the  aft  field  joints.  Gap 
opening  changes  (called  delta  gap  openings)  ver- 
sus time  are  shown  in  Figure  17  for  the  aft  field 
joints.  The  total  gap  at  any  time  also  depends  on 
the  initial  static  gap,  on  rounding  effects  during 
segment  pressurization,  and  on  loadings  due  to 
struts  and  airloads.  Sub-scale  tests  were  run  con- 
taining combinations  of  the  above  variables,  but 
did  not  include  the  effects  of  the  struts  and 
airloads. 


Right  Hand  SRM  AH  Field  Joint  Primary  And 
Secondary  Delta  Gap  Opening 
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Graph  plots  changes  In  right  booster's  aft  field  joint  primary 

and  secondary  gap  openings.  Horizontal  scale  is  time  in 

milliseconds  from  ignition. 
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Figure  18 

Drawings  show  how  progressive  reduction  of  gap  between 
tang  and  clevis  can  inhibit  and  eventually  block  motor  cavity's 
high-pressure  flow  from  getting  behind  O-rmg. 


O-Ring  Compression  at  Launch  (Static) 

As  noted  previously,  diameters  measured  just 
prior  to  assembly  do  not  permit  determination 
of  conditions  at  launch  because,  among  other 
things,  the  propellant  slowly  relaxes.  For  STS 
51-L,  the  difference  in  the  true  diameters  of  the 
surfaces  of  tang  and  clevis  measured  at  the  fac- 
tory was  0.008  inches.  Thus,  the  average  gap  at 
the  O-rings  between  the  tang  and  clevis  was  0.004 
inches.  The  minimum  gap  could  be  somewhat 
less,  and  possibly  metal-to-metal  contact  (zero 
gap)  could  exist  at  some  locations. 

During  the  investigation,  measurements  were 
made  on  segments  that  had  been  refurbished  and 
reused.  The  data  indicate  that  segment  cir- 
cumferences at  the  sealing  surfaces  change  with 
repeated  use.  This  expectation  was  not  unique 
to  this  joint. 

Recent  analysis  has  shown  and  tests  tend  to 
confirm  that  O-ring  sealing  performance  is 
significantly  improved  when  actuating  pressure 
can  get  behind  the  entire  face  of  the  O-ring  on 
the  upstream  side  of  the  groove  within  which  the 
O-ring  sits  (Figure  18).  If  the  groove  is  too  nar- 
row or  if  the  initial  squeeze  is  so  great  as  to  com- 
press the  O-ring  to  the  extent  that  it  fills  the  en- 
tire groove  and  contacts  all  groove  surfaces, 
pressure  actuation  of  the  seal  could  be  inhibited. 
This  latter  condition  is  relieved  as  the  joint  gap 
opens  and  the  O-ring  attempts  to  return  to  its  un- 
compressed shape.  However,  if  the  temperature 
is  low,  resiliency  is  severely  reduced  and  the  O- 
ring  is  very  slow  in  returning  towards  its  original 
shape.  Thus,  it  may  remain  compressed  in  the 


groove,  contact  all  three  surfaces  of  that  groove, 
and  inhibit  pressure  actuation  of  the  seal.  In  ad- 
dition, as  the  gap  opens  between  the  O-ring  and 
tang  surface  allowing  pressure  bypass,  O-ring  ac- 
tuation is  further  inhibited. 

Two  sub-scale  dynamic  test  fixtures  were 
designed  and  built  that  simulated  the  initial  static 
gap,  gap  opening  rate,  maximum  gap  opening 
and  ignition  transient  pressures.  These  fixtures 
were  tested  over  a  temperature  range  with  vary- 
ing initial  static  gap  openings.  A  summary  of 
results  with  initial  gap  openings  of  0.020  and 
0.004  inches  is  provided  in  Figure  19.  The  results 
indicate  that  with  a  0.020-inch  maximum  initial 
gap,  sealing  can  be  achieved  in  most  instances 
at  temperatures  as  low  as  25  degrees  Fahrenheit, 
while  with  the  0.004-inch  initial  gap,  sealing  is 
not  achieved  at  25  degrees  Fahrenheit  and  is 
marginal  even  in  the  40  and  50  degree  Fahrenheit 
temperature  range.  For  the  0.004-inch  initial  gap 
condition,  sealing  without  any  gas  blow-by,  did 
not  occur  consistently  until  the  temperature  was 
raised  to  55  degrees  Fahrenheit.  To  evaluate  the 
sensitivity  to  initial  gap  opening,  four  tests  were 
conducted  at  25  degrees  Fahrenheit  with  an  in- 
itial gap  of  0.010  inch.  In  contrast  to  the  tests  at 
a  0.004  inch  gap,  these  tests  resulted  in  sealing 
with  some  minimal  O-ring  blow-by  observed  dur- 
ing the  sealing  process. 

These  tests  indicate  the  sensitivity  of  the  O-ring 
seals  to  temperature  and  O-ring  squeeze  in  a  joint 
with  the  gap  opening  characteristics  of  the  Solid 
Rocket  Motors. 

It  should  be  noted  that  the  test  fixture  placed 
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Summary  of  Dynamic  Test  Results 


(4)PUSL-1  TEST 
PL7SB-3  TESTS 
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(4)  PL'SL-4  TESTS            (7) 
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(2)  PUSL-1  TEST 
PL/SB -1  TEST 


(6)  PB/SB-3  TESTS 


(     )  — Number  of  Tests 

BLANK  — No  Apparent  Leakage  or  Blow-By 

PL  — Primary  0-Rmg  Leak 

PB  —Primary  O-Ring  Blow-By 

SL  — Secondary  0-Rmg  Leak 

SB  —Secondary  0-Rmg  Blow-By 
—Data  Under  Evaluation 
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Figure  19 

Table  plots  results  of  tests  of  .004  and  .020  inch  initial  gap 

openings  over  the  range  of  temperatures  in  left  hand  vertical 

column. 


the  O-rings  at  a  specific  initial  gap  and  squeeze 
condition  uniformly  around  the  circumference. 
It  is  not  certain  what  the  effect  of  differences  in 
circumferential  gaps  might  be  in  full  size  joints. 
Such  effects  could  not  be  simulated  in  the  sub- 
scale  test  results  reported  above. 

Joint  Temperature 

Analyses  were  conducted  to  establish  STS  51-L 
joint  temperatures  at  launch.  Some  differences 
existed  among  the  six  51-L  field  joints.  The  joints 
on  the  right  Solid  Rocket  Motor  had  larger  cir- 
cumferential gradients  than  those  on  the  left 
motor  at  launch.  It  is  possible  that  the  aft  field 
joint  of  the  right  Solid  Rocket  Booster  was  at  the 
lowest  temperature  at  launch,  although  all  joints 
had  calculated  local  temperatures  as  low  as  28  ±  5 
degrees  Fahrenheit.  Estimated  transient 
temperature  for  several  circumferential  locations 
on  the  joints  are  shown  for  the  right  Solid  Rocket 
Motor  aft  field  joint  and  the  left  motor  aft  field 


joint  in  Figures  20  and  21.  These  data  are 
representative  of  other  joints  on  the  respective 
Solid  Rocket  Motors. 

The  investigation  has  shown  that  the  low 
launch  temperatures  had  two  effects  that  could 
potentially  affect  the  seal  performance:  (1)  O-ring 
resiliency  degradation,  the  effects  of  which  are 
explained  above;  and  (2)  the  potential  for  ice  in 
the  joints.  O-ring  hardness  is  also  a  function  of 
temperature  and  may  have  been  another  factor 
in  joint  performance. 

Consistent  results  from  numerous  O-ring  tests 
have  shown  a  resiliency  degradation  with  reduced 
temperatures.  Figure  23  provides  O-ring  recovery 
from  0.040  inches  of  initial  compression  versus 
time.  This  shows  how  quickly  an  O-ring  will 
move  back  towards  its  uncompressed  shape  at 
temperatures  ranging  from  10  to  75  degrees 
Fahrenheit.  When  these  data  are  compared  with 
the  gap  openings  versus  time  from  Figure  17,  it 
can  be  seen  that  the  O-rings  will  not  track  or 
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Aft  Right  Segment  Temperatures  for  STS  51 -L 
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Figure  20 

Temperature  model  for  51 -L  right  solid  booster  aft  segment 
circumferential  positions  from  1 6.5  hours  prior  to  launch  to  3.5 
hours  after  launch. 


Aft  Left  Segment  Temperatures  for  STS  51 -L 


Thermal  Model  Nodes 


Figure  21 

Temperature  model  for  51  -L  left  solid  booster  aft  segment  cir- 
cumferential positions  from  16.5  hours  prior  to  launch  until  3.5 
hours  after  launch. 
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Field  Joint  Distress 


SRB 

(right 

Previous 

or 

Angular 

Joint 

Use  oj 

Type  oj 

Flight 

Joint 

left) 

location 

Temp  (°F) 

Segments  (2) 

Distress 

STS-2 

AFT 

RH 

090 

70 

none/none 

Erosion 

41-B 

FWD 

LH 

351 

57 

1/none 

Erosion 

41-C 

AFT 

LH 

N/A 

63 

1/1 

O-ring  heat 

41-D 

FWD 

RH 

275/110 

70 

2/none 

Erosion 

51-C 

FWD 

LH 

163 

53 

1/none 

Erosion 

51-C  (3) 

MID 

RH 

354 

53 

1/1 

Erosion 

61 -A 

MID 

LH 

36-66 

75 

none/none 

Blow-by 

61 -A 

AFT 

LH 

338/018 

75 

none/none 

Blovv-bv 

61-C 

AFT 

LH 

154 

58 

1/none 

Erosion 

51-L 

AFT 

RH 

307 

28 

1/2 

Flame 

(1)  Mean  calculated  (  ±  5°F) 

(2)  Refurbished  after  recovery 

(3)  Both  primary  and  secondary  O-rings  affected 


Examination  of  the  records  shows  that  if  one  defines  any  sort 
of  damage  around  the  O-nng  as  "distress",  then  there  have 
been  10  "distressed"  field  joints,  including  the  aft  field  joint  on 
the  right-hand  booster  of  51-L.  These  data,  which  are 
tabulated  above,  show  10  instances  of  distress  in  a  total  of  150 
flight  exposures  One-half  of  the  instances  occurred  in  the  aft 
joint,  one-third  in  the  forward  joint,  and  one-fifth  in  the  mid- 
joint.  Sixty  percent  of  the  distress  occurred  in  the  left  Solid 
Rocket  Motor 


recover  to  the  gap  opening  by  600  milliseconds 
(gap  full  open)  at  low  to  moderate  temperatures. 
These  data  show  the  importance  of  timely  O-ring 
pressure  actuation  to  achieve  proper  sealing. 

It  is  possible  that  water  got  into  some,  if  not 
all  STS  51-L  field  joints.  Subsequent  to  the 
Challenger  accident,  it  was  learned  that  water  had 
been  observed  in  the  STS-9  joints  during  restack- 
ing  operations  following  exposure  to  less  rain  than 
that  experienced  by  STS  51-L.  It  was  reported 
that  water  had  drained  from  the  STS-9  joint  when 
the  pins  were  removed  and  that  approximately 
0.5  inch  of  water  was  present  in  the  clevis  well. 
While  on  the  pad  for  38  days,  STS  51-L  was  ex- 
posed to  approximately  seven  inches  of  rain. 
Analyses  and  tests  conducted  show  that  water  will 
freeze  under  the  environmental  conditions  ex- 
perienced prior  to  the  51-L  launch  and  could 
unseat  the  secondary  O-ring.  To  determine  the 
effects  of  unseating,  tests  were  conducted  on  the 
sub-scale  dynamic  test  fixture  at  Thiokol  to  fur- 
ther evaluate  seal  performance.  For  these  tests, 
water  was  frozen  downstream  of  the  secondary 
O-ring.  With  ice  present,  there  were  conditions 
under  which  the  O-ring  failed  to  seal. 


Putty  Performance 

The  significance  of  the  possibility  that  putty 
could  keep  the  motor  pressure  from  promptly 
reaching  the  O-rings  to  pressure  actuate  and  seal 
them  was  apparently  not  fully  appreciated  prior 
to  the  Challenger  accident.  During  the  investiga- 
tion, it  became  evident  that  several  variables  may 
affect  the  putty  performance  and,  in  turn,  seal 
performance.  However,  limited  test  data  and  lack 
of  fidelity  in  full  scale  joint  simulation  prevented 
a  complete  engineering  assessment  of  putty  per- 
formance. Tests  were  conducted  over  a  range  of 
putty  conditions,  including  temperature  at  igni- 
tion, pretest  conditioning  to  simulate  the  en- 
vironmental effects,  and  dimensional  variations 
within  the  joint.  These  test  results  demonstrated 
that  putty  performance  as  a  pressure  seal  is  highly 
variable.  The  results  may  be  interpreted  to  in- 
dicate that  the  putty  can  maintain  pressure  dur- 
ing the  ignition  transient  and  prevent  O-ring  seal- 
ing. For  example,  one  test  conducted  with  put- 
ty, which  had  been  conditioned  for  10  hours  at 
80  percent  relative  humidity  and  75  degrees 
Fahrenheit,  delayed  the  pressure  rise  at  the 
primary    O-ring    for    530    milliseconds    at    a 
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O-Ring  Recovery  vs.  Time 
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Figure  23 

Graph  plots  0-rmg  shape  recovery  in  inches  against  time  in 

seconds  for  a  variety  of  temperatures. 


Note:  Average  O-Rmg  Recovery  at  Various  Test  Tempera- 
tures During  First  Second  After  Load  Release.  Initial 
Compression  of  40  Mils  Was  Maintained  for  2  Hours. 


temperature  of  75  degrees.  Tests  at  20  degrees 
Fahrenheit  with  similarly  conditioned  putty 
delayed  the  pressurization  time  by  1.9  seconds. 
Such  delays  would  allow  full  joint  gap  opening 
before  a  seal  could  pressure  actuate. 

To  evaluate  this  effect,  a  sub-scale  test  fixture 
was  fabricated  that  effectively  simulated  gap 
opening  at  the  time  of  putty  rupture  and  pressure 
application.  The  tests  simulate  the  O-ring 
pressure  actuation  delay  due  to  the  putty  tem- 
porarily holding  the  motor  pressure.  They  were 
conducted  over  a  range  of  temperatures,  putty 
rupture  time  and  initial  O-ring  squeeze.  Test 
results  (Appendix  L,  Fig.  6.5.1)  demonstrated 
that  sealing  performance  is  dependent  on 
temperature  and  initial  squeeze,  both  of  which 
affect  the  pressure  actuation  capability  of  the  O- 
rings.  The  tests  indicate  that  sealing  capability- 
is  marginal  for  maximum  squeeze  conditions, 


i.e.,  a  0.004-inch  gap,  at  50  degrees  Fahrenheit 
with  a  pressure  delay  of  500  milliseconds.  For  the 
temperature  and  O-ring  squeeze  conditions  that 
existed  for  several  of  the  STS  51-L  field  joints, 
O-ring  sealing  was  not  achieved  in  these  tests  with 
simulated  putty  rupture  times  delayed  to  250  to 
500  milliseconds. 

Note  that  the  sub-scale  tests  do  not  faithfully 
reproduce  what  happens  in  the  real  joint.  These 
data  do  indicate,  however,  that  the  potential  ex- 
ists for  O-rings  not  to  seal  as  a  result  of  variables 
related  to  the  putty. 

The  seal  is  checked  by  pressurizing  the  volume 
between  the  primary  and  secondary  O-rings.  This 
action  seats  the  secondary  seal  and  drives  the 
primary  seal  upstream  into  its  groove.  Because 
of  concern  that  the  putty  could  mask  a  leaking 
primary  seal,  the  pressure  was  first  increased  from 
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50  psi  to  100  psi  and  then  to  200  psi.  The  conse- 
quence of  increasing  the  pressure  is  shown  below. 
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Clearly  the  increased  pressure  used  in  the  leak 
check  increased  the  likelihood  of  a  gas  path 
through  the  putty  to  the  primary  seal.  That  is, 
with  increased  pressure,  blow  holes  in  the  putty 
are  more  likely  with  a  resulting  greater  potential 
for  erosion  damage  to  the  O-ring.  On  the  positive 
side  the  blow  holes  tend  to  prevent  the  delay  in 
pressurization  discussed  in  the  previous 
paragraphs.  This  further  illustrates  the  influence 
of  putty  variables  on  the  performance  of  the  Solid 
Rocket  Motor  seals. 

The  Dynamic  Characteristics  of 
the  Field  Joint  Seal 

The  discussion  of  static  factors  which  affect 
joint  performance  is  based  on  the  assumption  that 
motor  segments  remain  perfectly  round,  and  that 
stacked  segments  are  always  a  perfectly  straight 
column.  At  launch  the  boosters  are  subjected  to 
forces  which  bend  and  twist  them.  These  forces 
cause  physical  changes  in  the  shape  of  the 
boosters,  actually  squashing  them  out-of-round 
and  bending  them  along  their  entire  length.  The 
dynamic  effects  of  this  out-of-roundness  are  most 
significant  just  after  booster  ignition  when  the 
hold-down  bolts  have  been  released  because  in 
the  previous  6.6  seconds  the  boosters  have  actual- 
ly been  bent  forward  by  the  thrust  from  the  main 
engines.  The  elastic  energy  stored  in  the  entire 
system  is  then  released,  inducing  a  bending  vibra- 
tion in  the  boosters.  This  bending  causes  the  case 
to  change  its  shape  from  circular  to  elliptical,  the 
maximum  out-of-roundness  occurring  on  the 
043-315  degree  line  on  the  outside  of  the  right 
booster.  This  deflection  is  a  consequence  of  a 
vibration  and  occurs  at  a  frequency  of  about  3 
(  ycles  per  second.  The  same  occurs  in  the  left 
booster,  only  the  deflection  axis  is  oriented  dif- 
ferently, being  a  mirror  image  of  that  which  takes 
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place  in  the  right  side.  The  dynamic  effects  cause 
an  increase  in  the  joint  rotation,  and,  hence,  in- 
c  rcase  the  gap  between  the  tang  and  clevis  by 
about  10  percent.  Another  dynamic  load  results 
from  the  geometry  of  the  struts  which  attach  the 
booster  to  the  external  tank.  Strut  P12  is  at- 
tached to  the  booster  at  about  the  314  degree 
point  and  imposes  additional  inertial  forces  on 
the  booster  which  tend  to  additionally  increase 
the  gap  by  10  to  21  percent. 

Analysis  of  the  Wreckage 

The  investigation  of  the  sequence  of  events  that 
led  to  the  final  breakup  of  the  Challenger  rests 
upon  three  primary  sources  of  data:  launch 
photographs,  telemetry  and  tracking  data,  and 
the  recovered  pieces  of  the  Shuttle  wreckage.  The 
third  source  of  data  is  presented  here,  which  is 
largely  descriptive.  It  provides  support  for  the 
conclusions  reached  through  use  of  the  data  from 
the  other  two  sources.  A  more  detailed  analysis 
that  provides  technical  details  to  be  used  for 
subsequent  redesign  or  accident  analysis  is 
available  in  the  appendix. 

Figure  24  shows  an  overview  of  the  search  areas 
with  the  general  location  of  parts  of  both  the  left 
and  the  right  Solid  Rocket  Boosters  indicated. 
The  area  is  at  the  edge  of  the  Gulf  Stream  in 
water  depth  that  ranged  from  100  to  1,200  feet. 
Pertinent  pieces  were  examined  by  use  of  a 
remotely  controlled  submarine  containing  a  flood 
light  and  a  television  camera.  The  television  pic- 
ture was  available  on  ship  board  and  was 
transmitted  to  Kennedy  and  to  Marshall.  The  ar- 
rangement allowed  a  number  of  people  who  were 
familiar  with  the  Solid  Rocket  Booster  to  com- 
ment upon  the  merit  of  recovering  a  particular 
piece. 

The  aft  left  side  of  the  Orbiter  contained  its 
original  paint  markings  and  showed  no  apparent 
sign  of  heat  damage  (photo  A.  All  photo 
references  are  to  color  section,  pp.  74-81).  Ther- 
mal distress,  however,  was  apparent  on  the  right 
rudder  speed  brake  panel  and  elevon  (photo  B). 
The  paint  was  scorched  and  blackened  on  the 
right  side  panels  of  the  aft  part  of  the  fuselage  and 
vertical  fin.  The  remaining  recovered  parts  of  the 
Orbiter  did  not  seem  to  be  affected  by  a  hydrogen 
fire.  The  bottom  side  of  the  right  wing  showed 
some  indentation  on  the  tiles  that  make  up  the 
Thermal  Protection  System.  This  indentation  was 
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consistent  with  impact  with  the  right  booster  as 
it  rotated  following  loss  of  restraint  of  one  or  more 
of  its  lower  struts. 

The  frustum  of  the  nose  cone  of  the  right  Solid 
Rocket  Booster  was  damaged  (photo  E)  as  if  it 
had  struck  the  External  Tank,  but  there  were  no 
signs  of  thermal  distress.  The  frustum  of  the  nose 
cone  of  the  left  Solid  Rocket  Booster  (photo  F) 
was  essentially  undamaged. 

A  substantial  part  of  the  External  Tank  was 
recovered.  Analysis  of  this  recovered  structure 
showed  some  interesting  features.  Interpretation 
of  the  photographs  suggests  that  the  flame  from 
the  right  hand  Solid  Rocket  Booster  encircled  the 
External  Tank.  A  short  time  later  the  dome  at 
the  base  of  the  External  Tank  was  thought  to 
break  free.  Since  the  internal  pressure  of  the  liq- 
uid hydrogen  tank  is  at  approximately  33  pounds 
per  square  inch,  a  sudden  venting  at  the  aft  sec- 
tion will  produce  a  large  initial  thrust  that  tails 
off  as  the  pressure  drops.  The  intertank  region 
of  the  wreckage  contained  buckling  in  the  fore 
and  aft  direction  consistent  with  this  impulsive 


thrust.  Similarly,  the  right  side  of  the  intertank 
showed  signs  of  crushing.  This  crushing  is  con- 
sistent with  the  rotational  impact  of  the  frustum 
of  the  right  Solid  Rocket  Booster  with  the  Exter- 
nal Tank  following  complete  loss  of  restraint  at 
the  aft  lower  strut  attachment  area. 

The  telemetered  signals  from  the  rate  gyros  in 
the  right  Solid  Rocket  Booster  clearly  show  a 
change  in  angular  velocity  of  the  booster  with 
respect  to  the  Orbiter.  It  is  believed  that  this 
velocity  change  was  initiated  by  a  failure  at  or 
near  the  PI 2  strut  connecting  the  booster  to  the 
External  Tank.  Photographs  of  the  flight  could 
not  define  the  failure  point  and  none  of  the  con- 
necting struts  to  the  right  Solid  Rocket  Booster 
or  the  corresponding  area  on  the  External  Tank 
in  this  region  were  recovered.  Therefore  the  ex- 
act location  of  initial  separation  could  not  be 
determined  by  the  evidence.  At  the  time  of 
relative  booster  movement,  the  hole  in  the  shell 
of  the  right  Solid  Rocket  Booster  was  calculated 
to  be  six  to  eight  inches  in  diameter  located  12 
to   15  inches  forward  and  adjacent  to  the  PI 2 
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Figure  25 

Drawing  depicts  pieces  of  right  Solid  Rocket  Booster  aft  seg- 
ment recovered  At  top  is  piece  of  aft  center  segment. 
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strut.  This  location  was  within  the  center  of  the 
burned  out  zone  on  the  right  Solid  Rocket  Booster 
(photo  G).  As  a  matter  of  interest,  the  P12  strut 
is  located  close  to  the  point  on  the  circumference 
where  the  booster  case  experiences  maximum 
radial  deflection  due  to  flight  loads.  It  seems  likely 
that  the  plume  from  the  hole  in  the  booster  would 
impact  near  the  location  of  the  P12  strut  connec- 
tion and  the  External  Tank.  Using  geometric  con- 
siderations alone  suggests  this  strut  separated 
from  the  External  Tank  before  it  separated  from 
the  right  hand  Solid  Rocket  Booster. 

figure  25  shows  a  sketch  of  an  interior  unroll- 
ed view  of  the  aft  part  of  the  right  hand  Solid 
Rocket  Booster  with  the  recovered  burned  pieces 
131  and  712  noted.  The  critical  region  is  between 


parts  131,  the  upper  segment  tang  region,  and 
part  712,  the  lower  clevis  region  of  the  joint.  This 
burned  area  extends  roughly  from  station  1476, 
in  the  upper  section,  to  1517  on  the  lower  region. 
In  a  circumferential  direction  (see  figure  26)  the 
lower  end  of  the  eroded  region  extends  from 
roughly  291  degrees  to  320  degrees  and  the  up- 
per eroded  section  extends  between  296  and  318 
degrees.  Note  that  the  region  at  about  314  degrees 
includes  the  attachment  region  of  the  strut  to  the 
attachment  ring  on  the  right  Solid  Rocket 
Booster. 

Some  observations  were  made  from  a  detailed 
examination  of  the  aft  center  section  of  the  joint, 
contact  131.  This  piece  (photo  I)  shows  a  large 
hole    that    is    approximately    centered    on    the 
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307-degree  circumferential  position.  Although  ir- 
regular, the  hole  is  roughly  rectangular  in  shape, 
extending  approximately  27  inches  circumferen- 
tially  along  the  tang  (296  to  318  degrees)  with 
total  burnout  extension  approximately  15  inches 
forward  of  the  tang.  At  either  side  in  the  interior 
of  the  hole  (photo  K)  the  insulation  and  steel  case 
material  showed  evidence  of  hot  gas  erosion  that 
beveled  these  surfaces  (indicative  of  combustion 
products  flowing  through  the  hole  from  the  in- 
terior of  the  Solid  Rocket  Motor).  The  top  sur- 
face of  the  hole  was  hardly  beveled  at  all.  The 


tang  O-ring  sealing  surface  next  to  either  side  of 
the  hole  showed  distinct  erosion  grooves  starting 
from  the  O-ring  locations  (photo  J).  These  ero- 
sion grooves  indicate  the  O-rings  were  sealing  the 
joint  away  from  the  central  area  during  the  later 
stages  of  the  trajectory.  No  other  evidence  of  ther- 
mal distress,  melting  or  burning  was  noted  in  the 
tang  section  of  the  joint. 

The  part  of  the  aft  section  of  the  right  Solid 
Rocket  Booster  in  the  circumferential  position  of 
the  hole  was  recovered  (photos  L  and  N).  This 
piece,  contact  712,  showed  evidence  of  a  burned 
hole  edge  extending  from  291  degrees  to  318 
degrees,  approximately  33  inches  long  (see 
bracket,  photo  L).  The  burned  surface  extended 
into  the  aft  attach  stub  region  of  the  case  adja- 
cent to  the  P  12  strut  attach  point.  The  box  struc- 
ture of  the  aft  attachment  ring  was  missing  from 
the  attach  stubs.  The  piece  displayed  fractures 
which  led  circumferentially  or  aft  from  the  hole 
and  the  burned  surface.  Booster  pieces  on  either 
side  have  not  been  recovered.  Thus  in  the  burn 
area  no  portion  of  the  clevis  or  attachment  ring 
other  than  the  stubs  was  available  for 
examination. 

The  exterior  surface  of  the  aft  case  piece  also 
contained  a  large  heat  affected  area  (photo  M). 
The  shape  and  location  of  this  area  indicates  a 
plume  impingement  from  the  escaping  gases.  The 
light  colored  material  at  the  downstream  edge  of 
the  area  is  probably  asbestos  from  the  insulator. 
The  rust  colored  line  more  or  less  parallel  to  the 
stubs  may  be  a  stagnation  line  produced  in  the 
gas  flow  when  the  gases  passed  around  the  attach- 
ment ring.  Secondary  flow  of  metal  from  the  aft 
attach  stub  ring  also  shows  this  feature.  There 
was  a  small  burn  hole  in  the  case  wall  (arrow, 
photo  O)  which  appeared  to  have  penetrated  the 
case  from  the  exterior  toward  the  interior.  This 
may  also  have  been  due  to  a  swirling  flow  of  hot 
gases  within  the  attachment  ring  box  structure. 
The  shadow  of  the  insulation  downstream  of  the 
attach  box  can  also  be  seen.  This  evidence  sug- 
gests strongly  that  a  hot  gas  plume  impinged 
against  the  attachment  ring,  passed  around  and 
through  it,  and  ultimately  destroyed  its  structural 
integrity,  probably  late  in  the  flight  of  the  Solid 
Rocket  Booster. 

The  photographs  L,  M,  N,  and  O  view  the 
lower  case  piece  in  the  inverted  position.  A  cor- 
rect orientation  of  this  piece  is  shown  in  a  com- 
posite view  of  the  burn  area  located  in  photo  P. 
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Findings 


1 .  A  combustion  gas  leak  through  the  right 
Solid  Rocket  Motor  aft  field  joint  initiated 
at  or  shortly  after  ignition  eventually  weaken- 
ed and/or  penetrated  the  External  Tank  ini- 
tiating vehicle  structural  breakup  and  loss  of 
the  Space  Shuttle  Challenger  during  STS 
Mission  51-L. 

2.  The  evidence  shows  that  no  other  STS  51-L 
Shuttle  element  or  the  payload  contributed 
to  the  causes  of  the  right  Solid  Rocket  Motor 
aft  field  joint  combustion  gas  leak.  Sabotage 
was  not  a  factor. 

3.  Evidence  examined  in  the  review  of  Space 
Shuttle  material,  manufacturing,  assembly, 
quality  control,  and  processing  of  non- 
conformance reports  found  no  flight  hard- 
ware shipped  to  the  launch  site  that  fell  out- 
side the  limits  of  Shuttle  design  specifications. 

4.  Launch  site  activities,  including  assembly 
and  preparation,  from  receipt  of  the  flight 
hardware  to  launch  were  generally  in  accord 
with  established  procedures  and  were  not 
considered  a  factor  in  the  accident. 

5.  Launch  site  records  show  that  the  right  Solid 
Rocket  Motor  segments  were  assembled  us- 
ing approved  procedures.  However,  signifi- 
cant out-of-round  conditions  existed  between 
the  two  segments  joined  at  the  right  Solid 
Rocket  Motor  aft  field  joint  (the  joint  that 
failed). 

a.  While  the  assembly  conditions  had  the 
potential  of  generating  debris  or  dam- 
age that  could  cause  O-ring  seal  failure, 
these  were  not  considered  factors  in  this 
accident. 

b.  The  diameters  of  the  two  Solid  Rocket 
Motor  segments  had  grown  as  a  result 
of  prior  use. 

c.  The  growth  resulted  in  a  condition  at 
time  of  launch  wherein  the  maximum 
gap  between  the  tang  and  clevis  in  the 
region  of  the  joint's  O-rings  was  no 
more  than  .008  inches  and  the  average 
gap  would  have  been  .004  inches. 

d.  With  a  tang-to-clevis  gap  of  .004 
inches,  the  O-ring  in  the  joint  would 
be  compressed  to  the  extent  that  it 
pressed  against  all  three  walls  of  the  O- 
ring  retaining  channel. 

e.  The  lack  of  roundness  of  the  segments 


was  such  that  the  smallest  tang-to-clevis 
clearance  occurred  at  the  initiation  of 
the  assembly  operation  at  positions  of 
120  degrees  and  300  degrees  around  the 
circumference  of  the  aft  field  joint.  It 
is  uncertain  if  this  tight  condition  and 
the  resultant  greater  compression  of  the 
O-rings  at  these  points  persisted  to  the 
time  of  launch. 

6.  The  ambient  temperature  at  time  of  launch 
was  36  degrees  Fahrenheit,  or  15  degrees 
lower  than  the  next  coldest  previous  launch. 

a.  The  temperature  at  the  300  degree 
position  on  the  right  aft  field  joint  cir- 
cumference was  estimated  to  be  28 
degrees  ±  5  degrees  Fahrenheit.  This 
was  the  coldest  point  on  the  joint. 

b.  Temperature  on  the  opposite  side  of  the 
right  Solid  Rocket  Booster  facing  the 
sun  was  estimated  to  be  about  50 
degrees  Fahrenheit. 

7.  Other  joints  on  the  left  and  right  Solid 
Rocket  Boosters  experienced  similar  com- 
binations of  tang-to-clevis  gap  clearance  and 
temperature.  It  is  not  known  whether  these 
joints  experienced  distress  during  the  flight 
of  51-L. 

8.  Experimental  evidence  indicates  that  due  to 
several  effects  associated  with  the  Solid 
Rocket  Booster's  ignition  and  combustion 
pressures  and  associated  vehicle  motions,  the 
gap  between  the  tang  and  the  clevis  will  open 
as  much  as  .017  and  .029  inches  at  the  sec- 
ondary and  primary  O-rings,  respectively. 

a.  This  opening  begins  upon  ignition, 
reaches  its  maximum  rate  of  opening 
at  about  200-300  milliseconds,  and  is 
essentially  complete  at  600  milliseconds 
when  the  Solid  Rocket  Booster  reaches 
its  operating  pressure. 

b.  The  External  Tank  and  right  Solid 
Rocket  Booster  are  connected  by 
several  struts,  including  one  at  310 
degrees  near  the  aft  field  joint  that  fail- 
ed. This  strut's  effect  on  the  joint 
dynamics  is  to  enhance  the  opening  of 
the  gap  between  the  tang  and  clevis  by 
about  10-20  percent  in  the  region  of 
300-320  degrees. 

9.  O-ring  resiliency  is  directly  related  to  its 
temperature. 

a.   A  warm  O-ring  that  has  been  com- 
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pressed  will  return  to  its  original  shape 
much  quicker  than  will  a  cold  O-ring 
when  compression  is  relieved.  Thus,  a 
warm  O-ring  will  follow  the  opening  of 
the  tang-to-clevis  gap.  A  cold  O-ring 
may  not. 

b.  A  compressed  O-ring  at  75  degrees 
Fahrenheit  is  five  times  more  respon- 
sive in  returning  to  its  uncompressed 
shape  than  a  cold  O-ring  at  30  degrees 
Fahrenheit. 

c.  As  a  result  it  is  probable  that  the  O- 
rings  in  the  right  solid  booster  aft  field 
joint  were  not  following  the  opening  of 
the  gap  between  the  tang  and  clevis  at 
time  of  ignition. 

10.  Experiments  indicate  that  the  primary 
mechanism  that  actuates  O-ring  sealing  is  the 
application  of  gas  pressure  to  the  upstream 
(high-pressure)  side  of  the  O-ring  as  it  sits 
in  its  groove  or  channel. 

a.  For  this  pressure  actuation  to  work 
most  effectively,  a  space  between  the 
O-ring  and  its  upstream  channel  wall 
should  exist  during  pressurization. 

b.  A  tang-to-clevis  gap  of  .004  inches,  as 
probably  existed  in  the  failed  joint, 
would  have  initially  compressed  the  O- 
ring  to  the  degree  that  no  clearance  ex- 
isted between  the  O-ring  and  its 
upstream  channel  wall  and  the  other 
two  surfaces  of  the  channel. 

c.  At  the  cold  launch  temperature  ex- 
perienced, the  O-ring  would  be  very 
slow  in  returning  to  its  normal  round- 
ed shape.  It  would  not  follow  the  open- 
ing of  the  tang-to-clevis  gap.  It  would 
remain  in  its  compressed  position  in  the 
O-ring  channel  and  not  provide  a  space 
between  itself  and  the  upstream  chan- 
nel wall.  Thus,  it  is  probable  the  O-ring 
would  not  be  pressure  actuated  to  seal 
the  gap  in  time  to  preclude  joint  failure 
due  to  blow-by  and  erosion  from  hot 
combustion  gases. 

11.  The  sealing  characteristics  of  the  Solid 
Rocket  Booster  O-rings  are  enhanced  by 
timely  application  of  motor  pressure. 

a.  Ideally,  motor  pressure  should  be  ap- 
plied to  actuate  the  O-ring  and  seal  the 
joint  prior  to  significant  opening  of  the 


tang-to-clevis  gap  (100  to  200  milli- 
seconds after  motor  ignition). 

b.  Experimental  evidence  indicates  that 
temperature,  humidity  and  other 
variables  in  the  putty  compound  used 
to  seal  the  joint  can  delay  pressure  ap- 
plication to  the  joint  by  500  milli- 
seconds or  more. 

c.  This  delay  in  pressure  could  be  a  fac- 
tor in  initial  joint  failure. 

12.  Of  21  launches  with  ambient  temperatures 
of  61  degrees  Fahrenheit  or  greater,  only  four 
showed  signs  of  O-ring  thermal  distress;  i.e., 
erosion  or  blow-by  and  soot.  Each  of  the 
launches  below  61  degrees  Fahrenheit 
resulted  in  one  or  more  O-rings  showing 
signs  of  thermal  distress. 

a.  Of  these  improper  joint  sealing  actions, 
one-half  occurred  in  the  aft  field  joints, 
20  percent  in  the  center  field  joints,  and 
30  percent  in  the  upper  field  joints.  The 
division  between  left  and  right  Solid 
Rockter  Boosters  was  roughly  equal. 

b.  Each  instance  of  thermal  O-ring 
distress  was  accompanied  by  a  leak 
path  in  the  insulating  putty.  The  leak 
path  connects  the  rocket's  combustion 
chamber  with  the  O-ring  region  of  the 
tang  and  clevis.  Joints  that  actuated 
without  incident  may  also  have  had 
these  leak  paths. 

1 3 .  There  is  a  possibility  that  there  was  water  in 
the  clevis  of  the  STS  5 1-L  joints  since  water 
was  found  in  the  STS-9  joints  during  a 
destack  operation  after  exposure  to  less  rain- 
fall than  STS  5 1-L.  At  time  of  launch,  it  was 
cold  enough  that  water  present  in  the  joint 
would  freeze.  Tests  show  that  ice  in  the  joint 
can  inhibit  proper  secondary  seal 
performance. 

14.  A  series  of  puffs  of  smoke  were  observed 
emanating  from  the  5 1-L  aft  field  joint  area 
of  the  right  Solid  Rocket  Booster  between 
0.678  and  2.500  seconds  after  ignition  of  the 
Shuttle  Solid  Rocket  Motors. 

a.  The  puffs  appeared  at  a  frequency  of 
about  three  puffs  per  second.  This 
roughly  matches  the  natural  structural 
frequency  of  the  solids  at  lift  off  and  is 
reflected  in  slight  cyclic  changes  of  the 
tang-to-clevis  gap  opening. 
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15. 


16. 


b.  The  puffs  were  seen  to  be  moving  up- 
ward along  the  surface  of  the  booster 
above  the  aft  field  joint. 

c.  The  smoke  was  estimated  to  originate 
at  a  circumferential  position  of  between 
270  degrees  and  315  degrees  on  the 
booster  aft  field  joint,  emerging  from 
the  top  of  the  joint. 

This  smoke  from  the  aft  field  joint  at  Shut- 
tle lift  off  was  the  first  sign  of  the  failure  of 
the  Solid  Rocket  Booster  O-ring  seals  on  STS 
51-L. 

The  leak  was  again  clearly  evident  as  a  flame 
at  approximately  58  seconds  into  the  flight. 
It  is  possible  that  the  leak  was  continuous  but 
unobservable  or  non-existent  in  portions  of 
the  intervening  period.  It  is  possible  in  either 
case  that  thrust  vectoring  and  normal  vehi- 
cle response  to  wind  shear  as  well  as  planned 
maneuvers  reinitiated  or  magnified  the 
leakage  from  a  degraded  seal  in  the  period 
preceding  the  observed  flames.  The  esti- 
mated position  of  the  flame,  centered  at  a 
point  307  degrees  around  the  circumference 
of  the  aft  field  joint,  was  confirmed  by  the 
recovery  of  two  fragments  of  the  right  Solid 
Rocket  Booster. 

a.  A  small  leak  could  have  been  present 
that  may  have  grown  to  breach  the 
joint  in  flame  at  a  time  on  the  order  of 
58  to  60  seconds  after  lift  off. 

b.  Alternatively,  the  O-ring  gap  could 
have  been  resealed  by  deposition  of  a 
fragile  buildup  of  aluminum  oxide  and 
other  combustion  debris.  This  resealed 
section  of  the  joint  could  have  been 
disturbed  by  thrust  vectoring,  Space 
Shuttle  motion  and  flight  loads  induc- 
ed by  changing  winds  aloft. 

c.  The  winds  aloft  caused  control  actions 
in  the  time  interval  of  32  seconds  to  62 
seconds  into  the  flight  that  were  typical 
of  the  largest  values  experienced  on 
previous  missions. 


Conclusion 


In  view  of  the  findings,  the  Commission  concluded 
that  the  cause  of  the  Challenger  accident  was  the  failure 
of  the  pressure  seal  in  the  aft  field  joint  of  the  right  Solid 
Rocket  Motor.  The  failure  was  due  to  a  faulty 
design  unacceptably  sensitive  to  a  number  of  fac- 
tors. These  factors  were  the  effects  of  tempera- 
ture, physical  dimensions,  the  character  of 
materials,  the  effects  of  reusability,  processing, 
and  the  reaction  of  the  joint  to  dynamic 
loading.  ■ 
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The  upper  photos  show,  from  left  to  right,  the  left  side  of 
the  Orbiter  (unburned),  the  right  lower  and  upper  rudder 
speed  brake  (both  burn  damaged)  and  left  upper  speed 
brake  (unburned),  confirmation  that  the  fire  was  on  the 


right  side  of  the  Shuttle  stack.  The  lower  photos  show 
the  range  safety  destruct  charges  in  the  External  Tank. 
These  charges  were  exonerated  when  they  were 
recovered  intact  and  undetonated. 
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The  frustums  on  the  left  page  are  parts  of 
the  Solid  Rocket  Booster  forward 
assemblies  that  contain  recovery 
parachutes,  location  aids  and  flotation 
devices.  The  frustum  of  the  left  hand 
booster  (lower  left)  is  virtually  undamaged. 
The  right  frustum  shows  impact  damage  at 
top  and  burns  along  the  base  of  the  cone; 
evidence  indicates  it  was  damaged  when  it 
impacted  with  the  External  Tank.  Shown  at 
right  above  is  another  Solid  Rocket  Motor 
stack  crosshatched  to  show  the  burned 
area  of  the  right  booster's  aft  joint 
(diagram  at  right).  The  flame  from  the  hole 
impinged  on  the  External  Tank  and  caused 
a  failure  at  the  aft  connection  at  the  Exter- 
nal Tank. 
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Examined  at  Kennedy  Space 
Center  after  their  recovery 
from  the  ocean,  these  frag- 
ments show  the  extent  of 
burn  through  the  right  hand 
booster's  aft  field  joint  On 
the  left  page  are  sections  of 
the  aft  center  motor  seg- 
ment above  the  joint.  On  the 
right  page  are  sections  (in- 
verted) of  the  aft  motor  seg- 
ment showing  burn-hole 
below  the  joint  (bracket).  Ex- 
cept for  the  interior  views  on 
lower  left,  the  camera  is 
viewing  the  parts  from  out- 
side the  casing. 


At  upper  left  is  the  aft  seg- 
ment burn  viewed  from  inside 
the  casing;  the  lower  photo  is 
a  closeup  of  the  same  sec- 
tion. The  latter  photo  shows  a 
hole  (arrow)  where  the  flame 
plume  may  have  burned 
through  the  casing  from  the 
outside.  At  right  is  a  compos- 
ite view  of  the  burn  above 
and  below  the  aft  field  joint. 
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Chapter  V 


The  Contributing 
Cause  Of 
The  Accident 


The  decision  to  launch  the  Challenger 
was  flawed.  Those  who  made  that 
decision  were  unaware  of  the  recent 
history  of  problems  concerning  the 
O-rings  and  the  joint  and  were  unaware  of  the 
initial  written  recommendation  of  the  contractor 
advising  against  the  launch  at  temperatures  below 
53  degrees  Fahrenheit  and  the  continuing  opposi- 
tion of  the  engineers  at  Thiokol  after  the  manage- 
ment reversed  its  position.  They  did  not  have  a 
clear  understanding  of  Rockwell's  concern  that 
it  was  not  safe  to  launch  because  of  ice  on  the 
pad.  If  the  decisionmakers  had  known  all  of  the 
facts,  it  is  highly  unlikely  that  they  would  have 
decided  to  launch  51-L  on  January  28,  1986. 

Flaws  In  The  Decision 
Making  Process 

In  addition  to  analyzing  all  available  evidence 
concerning  the  material  causes  of  the  accident  on 
January'  28,  the  Commission  examined  the  chain 
of  decisions  that  culminated  in  approval  of  the 
launch.  It  concluded  that  the  decision  making 
process  was  flawed  in  several  ways.  The  actual 
events  that  produced  the  information  upon  which 
the  approval  of  launch  was  based  are  recounted 
and  appraised  in  the  sections  of  this  chapter.  The 
discussion  that  follows  relies  heavily  on  excerpts 
from  the  testimony  of  those  involved  in  the 
management  judgments  that  led  to  the  launch  of 
the  Challenger  under  conditions  described. 

That  testimony  reveals  failures  in  communica- 
tion that  resulted  in  a  decision  to  launch  51-L 
based  on  incomplete  and  sometimes  misleading 
information,  a  conflict  between  engineering  data 


and  management  judgments,  and  a  NASA  man- 
agement structure  that  permitted  internal  flight 
safety  problems  to  bypass  key  Shuttle  managers. 

The  Shuttle  Flight  Readiness  Review  is  a  care- 
fully planned,  step-by-step  activity,  established 
by  NASA  program  directive  SPO-PD  710.5A,1 
designed  to  certify  the  readiness  of  all  components 
of  the  Space  Shuttle  assembly.  The  process  is 
focused  upon  the  Level  I  Flight  Readiness 
Review,  held  approximately  two  weeks  before  a 
launch.  The  Level  I  review  is  a  conference 
chaired  by  the  NASA  Associate  Administrator  for 
Space  Flight  and  supported  by  the  NASA  Chief 
Engineer,  the  Program  Manager,  the  center 
directors  and  project  managers  from  Johnson, 
Marshall  and  Kennedy,  along  with  senior  con- 
tractor representatives. 

The  formal  portion  of  the  process  is  initiated 
by  directive  from  the  Associate  Administrator  for 
Space  Flight.  The  directive  outlines  the  schedule 
for  the  Level  I  Flight  Readiness  Review  and  for 
the  steps  that  precede  it.  The  process  begins  at 
Level  IV  with  the  contractors  formally  cer- 
tifying—in writing  — the  flight  readiness  of  the 
elements  for  which  they  are  responsible.  Certifica- 
tion is  made  to  the  appropriate  Level  III  NASA 
project  managers  at  Johnson  and  Marshall.  Ad- 
ditionally, at  Marshall  the  review  is  followed  by 
a  presentation  directly  to  the  Center  Director.  At 
Kennedy  the  Level  III  review,  chaired  by  the 
Center  Director,  verifies  readiness  of  the  launch 
support  elements. 

The  next  step  in  the  process  is  the  Certifica- 
tion of  Flight  Readiness  to  the  Level  II  Program 
Manager  at  Johnson.  In  this  review  each  Space 
Shuttle  program  element  endorses  that  it  has 
satisfactorily    completed    the    manufacture, 


82 


assembly,  test  and  checkout  of  the  pertinent  ele- 
ment, including  the  contractors'  certification  that 
design  and  performance  are  up  to  standard.  The 
Flight  Readiness  Review  process  culminates  in 
the  Level  I  review. 

In  the  initial  notice  of  the  review,  the  Level  I 
directive  establishes  a  Mission  Management 
Team  for  the  particular  mission.  The  team 
assumes  responsibility  for  each  Shuttle's  readiness 
for  a  period  commencing  48  hours  before  launch 
and  continuing  through  post-landing  crew  egress 
and  the  safing  of  the  Orbiter.  On  call  throughout 
the  entire  period,  the  Mission  Management 
Team  supports  the  Associate  Administrator  for 
Space  Flight  and  the  Program  Manager. 


A  structured  Mission  Management  Team 
meeting  — called  L-l—  is  held  24  hours,  or  one 
day,  prior  to  each  scheduled  launch.  Its  agenda 
includes  closeout  of  any  open  work,  a  closeout 
of  any  Flight  Readiness  Review  action  items,  a 
discussion  of  new  or  continuing  anomalies,  and 
an  updated  briefing  on  anticipated  weather  con- 
ditions at  the  launch  site  and  at  the  abort  land- 
ing sites  in  different  parts  of  the  world.  It  is  stand- 
ard practice  of  Level  I  and  II  officials  to  en- 
courage the  reporting  of  new  problems  or  con- 
cerns that  might  develop  in  the  interval  between 
the  Flight  Readiness  Review  and  and  the  L-l 
meeting,  and  between  the  L-l  and  launch. 

In  a  procedural  sense,  the  process  described 
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was  followed  in  the  case  of  flight  51-L.  However, 
in  the  launch  preparation  for  51-L  relevant  con- 
cerns of  Level  III  NASA  personnel  and  element 
contractors  were  not,  in  the  following  crucial 
areas,  adequately  communicated  to  the  NASA 
Level  I  and  II  management  responsible  for  the 
launch: 

■  The  objections  to  launch  voiced  by  Morton 
Thiokol  engineers  about  the  detrimental  ef- 
fect of  cold  temperatures  on  the  performance 
of  the  Solid  Rocket  Motor  joint  seal. 

■  The  degree  of  concern  of  Thiokol  and  Mar- 
shall about  the  erosion  of  the  joint  seals  in 
prior  Shuttle  flights,  notably  51-C  (January, 
1985)  and  51-B  (April,  1985). 

On  December  13,  1985,  the  Associate  Ad- 
ministrator for  Space  flight,  Jesse  Moore,  sent 
out  a  message  distributed  among  NASA  Head- 
quarters, NASA  field  centers,  and  U.S.  Air  Force 
units,  that  scheduled  the  Flight  Readiness  Review 
for  January  15,  1986,  and  prescribed  the  dates 
for  the  other  steps  in  the  standard  procedure. 

The  message  was  followed  by  directives  from 
James  A.  (Gene)  Thomas,  Deputy  Director  of 
Launch  and  Landing  Operations  at  Kennedy  on 
January  2,  1986;  by  the  National  Space 
Transportation  System  Program  Manager,  Ar- 
nold Aldrich,  on  January  3;  by  William  R. 
Lucas,  the  Marshall  Center  Director,  on  January 
7;  and  by  the  Marshall  Shuttle  Projects  Office  on 
January  8.  Each  of  these  implementing  directives 
prescribed  for  Level  III  the  preparatory  steps  for 
the  Flight  Readiness  Review. 

The  Flight  Readiness  Review  was  held,  as 
scheduled,  on  January  15.  On  the  following  day, 
Aldrich  issued  the  schedule  for  the  combined 
Level  I/Mission  Management  Team  meetings; 
he  also  announced  plans  for  the  Mission  Manage- 
ment Team  meetings  continuing  throughout  the 
mission  and  included  the  schedule  for  the  L-l 
review  . 

On  January  23,  Moore  issued  a  directive 
stating  that  the  Flight  Readiness  Review  had  been 
conducted  on  the  15th  and  that  51-L  was  ready 
to  fly  pending  closeout  of  open  work,  satisfactory 
countdown .  and  completion  of  remaining  Flight 
Readiness  Review  action  items,  which  were  to 
be  closed  out  during  the  L-l  meeting.  No  prob- 
lems with  the  Solid  Rocket  Booster  were 
identified. 

Since  December.  1982.  the  O-rings  had  been 
designated  a  "Criticality   1"  feature  of  the  Solid 
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DISTRIBUTION 

SUBJECT:      STS    Jl-L   FLICHT   READINESS   REVIEW 

THE    STS    Sl-L    FLIGHT    READINESS    REVIEW    (FUR)    IS    SCHEDULED 
FOR    JANUARY    IS,     19»6    FROM    2:00-4:30    FM    EST.       THE    LEVEL    II 
NSTS   OFFICE    IS    RBSFONSIBLB   FOR    IMFLBMBNTING  THIS   REVIEW. 
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The  NASA  Associate  Administrator  for  Space  Flight 
issued  this  notice  of  scheduling  of  the  Flight  Readiness 
Review  for  mission  51-L. 


Rocket  Booster  design,  a  term  denoting  a  failure 
point  —  without  back-up  — that  could  cause  a  loss 
of  life  or  vehicle  if  the  component  fails.  In  July. 
1985,  after  a  nozzle  joint  on  STS  51-B  showed 
erosion  of  a  secondary  O-ring,  indicating  that  the 
primary  seal  failed,  a  launch  constraint  was 
placed  on  flight  51-F  and  subsequent  launches. 
These  constraints  had  been  imposed  and  regular- 
ly waived  by  the  Solid  Rocket  Booster  Project 
Manager  at  Marshall,  Lawrence  B.  Mulloy. 

Neither  the  launch  constraint,  the  reason  for 
it,  or  the  six  consecutive  waivers  prior  to  51-L 
were  known  to  Moore  (Level  I)  or  Aldrich  (Level 
II)  or  Thomas  at  the  time  of  the  Flight  Readiness 
Review  process  for  51-L. 

It  should  be  noted  that  there  were  other  and 
independent  paths  of  system  reporting  that  were 
designed  to  bring  forward  information  about  the 
Solid  Rocket  Booster  joint  anomalies.  One  path 
was  the  task  force  of  Thiokol  engineers  and  Mar- 
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shall  engineers  who  had  been  conducting  subscale 
pressure  tests  at  Wasatch  during  1985,  a  source 
of  documented  rising  concern  and  frustration  on 
the  part  of  some  of  the  Thiokol  participants  and 
a  few  of  the  Marshall  participants.  But  Level  II 
was  not  in  the  line  of  reporting  for  this  activity. 
Another  path  was  the  examination  at  each  Flight 
Readiness  Review  of  evidence  of  earlier  flight 
anomalies.  For  51-L,  the  data  presented  in  this 
latter  path,  while  it  reached  Levels  I  and  II,  never 
referred  to  either  test  anomalies  or  flight 
anomalies  with  O-rings. 

In  any  event,  no  mention  of  the  O-ring  prob- 
lems in  the  Solid  Rocket  Booster  joint  appeared 
in  the  Certification  of  Flight  Readiness,  signed 
for  Thiokol  on  January  9,  1986,  by  Joseph 
Kilminster,  for  the  Solid  Rocket  Booster  set 
designated  BI026.2 

Similarly,  no  mention  appeared  in  the  certifica- 
tion endorsement,  signed  on  January  15,  1986, 
by  Kilminster  and  by  Mulloy,3  No  mention  ap- 
pears in  several  inches  of  paper  comprising  the 
entire  chain  of  readiness  reviews  for  51-L.4 

In  the  51-L  readiness  reviews,  it  appears  that 
neither  Thiokol  management  nor  the  Marshall 
Level  III  project  managers  believed  that  the  O- 
ring  blow-by  and  erosion  risk  was  critical.  The 
testimony  and  contemporary  correspondence 
show  that  Level  III  believed  there  was  ample 
margin  to  fly  with  O-ring  erosion,  provided  the 
leak  check  was  performed  at  200  pounds  per 
square  inch. 

Following  the  January  15  Flight  Readiness 
Review  each  element  of  the  Shuttle  was  certified 
as  flight-ready. 

The  L-l  Mission  Management  Team  meeting 
took  place  as  scheduled  at  11:00  a.m.  Eastern 
Standard  Time  January  25.  No  technical  issues 
appeared  at  this  meeting  or  in  the  documenta- 
tion and  all  Flight  Readiness  Review  actions  were 
reported  closed  out. 

Mr.  Mulloy  testified  as  follows  regarding  the 
Flight  Readiness  Review  record  about  O-ring 
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concerns: 


Chairman  Rogers:  .  .  .  Why  wasn't  that  a 
cause  for  concern  on  the  part  of  the  whole 
NASA  organization? 

Mr.  Mulloy:  It  was  cause  for  concern,  sir. 

Chairman  Rogers:  Who  did  vou  tell  about 
this? 

Mr.  Mulloy:  Everyone,  sir. 


Chairman  Rogers:  And  they  all  knew  about 
it  at  the  time  of  51-L? 

Mr.  Mulloy:  Yes,  sir.  You  will  find  in  the 
Flight  Readiness  Review  record  that  went 
all  the  way  to  the  L-l  review. 

It  is  disturbing  to  the  Commission  that  con- 
trary to  the  testimony  of  the  Solid  Rocket  Booster 
Project  Manager,  the  seriousness  of  concern  was 
not  conveyed  in  Flight  Readiness  Review  to  Level 
I  and  the  51-L  readiness  review  was  silent. 

The  only  remaining  issue  facing  the  Mission 
Management  Team  at  the  L-l  review  was  the  ap- 
proaching cold  front,  with  forecasts  of  rain 
showers  and  temperatures  in  the  mid-sixties. 
There  had  also  been  heavy  rain  since  51-L  had 
been  rolled  out  to  the  launch  pad,  approximate- 
ly seven  inches  compared  with  the  2.5  inches  that 
would  have  been  normal  for  that  season  and* 
length  of  exposure  (35  days). 

At  12:36  p.m.  on  the  27th,  the  Mission 
Management  Team  scrubbed  the  launch  for  that 
day  due  to  high  cross  winds  at  the  launch  site. 
In  the  accompanying  discussion  that  ran  for  about 
half  an  hour,  all  appropriate  personnel  were 
polled  as  to  the  feasibility  of  a  launch  within  24 
hours.  Participants  were  requested  to  identify  any 
constraints.  This  meeting,  aimed  at  launch  at 
9:38  a.m.  on  January  28,  produced  no  constraints 
or  concerns  about  the  performance  of  the  Solid 
Rocket  Boosters. 

At  2:00  p.m.  on  the  27th,  the  Mission  Manage- 
ment Team  met  again.  At  that  time,  the  weather 
was  expected  to  clear,  but  it  appeared  that 
temperatures  would  be  in  the  low  twenties  for 
about  11  hours.  Issues  were  raised  with  regard 
to  the  cold  weather  effects  on  the  launch  facility, 
including  the  water  drains,  the  eye  wash  and 
shower  water,  fire  suppression  system,  and  over- 
pressure water  trays.  It  was  decided  to  activate 
heaters  in  the  Orbiter,  but  no  concerns  were  ex- 
pressed about  the  O-rings  in  the  Solid  Rocket 
Boosters.  The  decision  was  to  proceed  with  the 
countdown  and  with  fueling,  but  all  members  of 
the  team  were  asked  to  review  the  situation  and 
call  if  any  problems  arose. 

At  approximately  2:30  p.m.  EST,  at  Thiokol's 
Wasatch  plant,  Robert  Ebeling,  after  learning  of 
the  predicted  low  temperature  for  launch,  con- 
vened a  meeting  with  Roger  Boisjoly  and  with 
other  Thiokol  engineers.  A  brief  chronology  of 
the  subsequent  chain  of  events  begins  on  page 
104.  Ebeling  was  concerned  about  predicted  cold 
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temperatures  at  Kennedy  Space  Center.  In  a 
post-accident  interview,  Mr.  Ebeling  recalled  the 
substance  of  the  meeting.6 

"The  meeting  lasted  one  hour,  but  the 
conclusion  of  that  meeting  was  Engineer- 
ing—especially Arnie.  Roger  Boisjoly,  Brian 
Russell,  myself,  Jerry  Burns,  they  come  to 
mind  —  were  very  adamant  about  their  con- 
cerns on  this  lower  temperature,  because  we 
were  way  below  our  data  base  and  we  were 
way  below  what  we  qualified  for." 

Later  in  the  afternoon  on  the  same  day,  Allan 
McDonald  — Thiokol's  liaison  for  the  Solid  Rocket 
Booster  project  at  Kennedy  Space  Center  — 
received  a  telephone  call  from  Ebeling,  express- 
ing concern  about  the  performance  of  the  Solid 
Rocket  Booster  field  joints  at  low  temperatures. 
During  testimony  before  the  Commission  on 
February  27,  McDonald  recounted  that 
conversation:7 

Mr.  McDonald:  Well,  I  had  first  become 
aware  of  the  concern  of  the  low  temperatures 
that  were  projected  for  the  Cape,  it  was  late 
in  the  afternoon  of  the  27th.  I  was  at  Carver 
Kennedy's  house.  He  is  a  vice  president  of, 
as  I  mentioned,  our  space  operations  center 
at  the  Cape,  and  supports  the  stacking  of  the 
SRMs  [Solid  Rocket  Motors]. 

And  I  had  a  call  from  Bob  Ebeling.  He 
is  the  manager  of  our  ignition  system  and 
final  assembly,  and  he  worked  for  me  as  pro- 
gram manager  at  Thiokol  in  Utah.  And  he 
called  me  and  said  that  they  had  just  received 
some  word  earlier  that  the  weatherman  was 
projecting  temperatures  as  low  as  18  degrees 
Fahrenheit  some  time  in  the  early  morning 
hours  of  the  28th,  and  that  they  had  some 
meetings  with  some  of  the  engineering  peo- 
ple and  had  some  concerns  about  the  O-rings 
getting  to  those  kinds  of  temperatures. 

And  he  wanted  to  make  me  aware  of  that 
and  also  wanted  to  get  some  more  updated 
and  better  information  on  what  the  actual 
temperature  was  going  to  be  depicted,  so 
that  they  could  make  some  calculations  on 
what  they  expected  the  real  temperature  the 
O-rings  may  see.  .  .  . 

I  told  him  that  I  would  get  that 
temperature  data  for  him  and  call  him  back. 
Carver  Kennedy  then,  when  I  hung  up,  call- 
ed the  launch  operations  center  to  get  the 


predicted  temperatures  from  pad  B,  as  well 
as  what  the  temperature  history  had  been 
during  the  day  up  until  that  time. 

.  .  .  He  obtained  those  temperatures  from 
the  launch  operations  center,  and  they 
basically  said  that  they  felt  it  was  going  to 
get  near  freezing  or  freezing  before  mid- 
night. It  would  get  as  low  as  22  degrees  as 
a  minimum  in  the  early  morning  hours, 
probably  around  6:00  o'clock,  and  that  they 
were  predicting  a  temperature  of  about  26 
degrees  at  the  intended  time,  about  9:38  the 
next  morning. 

I  took  that  data  and  called  back  to  the 
plant  and  sent  it  to  Bob  Ebeling  and  relayed 
that  to  him,  and  told  him  he  ought  to  use 
this  temperature  data  for  his  predictions,  but 
I  thought  this  was  very  serious  and  to  make 
sure  that  he  had  the  vice  president,  engineer- 
ing, involved  in  this  and  all  of  his  people; 
that  I  wanted  them  to  put  together  some 
calculations  and  a  presentation  of  material. 
Chairman  Rogers:  Who's  the  Vice  Presi- 
dent, Engineering? 

Mr.  McDonald:  Mr.  Bob  Lund  is  our  Vice 
President,  Engineering,  at  our  Morton 
Thiokol  facility  in  Utah. 

To  make  sure  he  was  involved  in  this,  and 
that  this  decision  should  be  an  engineering 
decision,  not  a  program  management  deci- 
sion. And  I  told  him  that  I  would  like  him 
to  make  sure  they  prepared  some  charts  and 
were  in  a  position  to  recommend  the  launch 
temperature  and  to  have  the  rationale  for 
supporting  that  launch  temperature. 

I  then  hung  up  and  I  called  Mr.  Mulloy. 
He  was  staying  at  the  Holiday  Inn  in  Mer- 
ritt  Island  and  they  couldn't  reach  him,  and 
so  I  called  Cecil  Houston  — Cecil  Houston 
is  the  resident  manager  for  the  Marshall 
Space  Flight  Center  office  at  KSC  [Kennedy 
Space  Center]  —  and  told  him  about  our  con- 
cerns with  the  low  temperatures  and  the 
potential  problem  with  the  O-rings. 

And  he  said  that  he  would  set  up  a 
teleconference.  He  had  a  four-wire  system 
next  to  his  office.  His  office  is  right  across 
from  the  VAB  [Vehicle  Assembly  Building] 
in  the  trailer  complex  C  over  there.  And  he 
would  set  up  a  four-wire  teleconference  in- 
volving the  engineering  people  at  Marshall 
Space  Flight  Center  at  Huntsville,  our  peo- 
ple back  at  Thiokol  in  Utah;  and  that  I 
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should  come  down  to  his  office  and  par- 
ticipate at  Kennedy  from  there,  and  that  he 
would  get  back  with  me  and  let  me  know 
when  that  time  would  be. 

Soon  thereafter  Cecil  Houston  called  Dr.  Jud- 
son  Lovingood,  Deputy  Shuttle  Project  Manager 
at  Marshall  Space  Flight  Center,  to  inform  him 
of  the  concerns  about  the  O-rings  and  asked  Lov- 
ingood to  set  up  a  teleconference  with  senior  proj- 
ect management  personnel,  with  George  Hardy, 
Marshall's  Deputy  Director  of  Science  and 
Engineering,  and  with  Morton  Thiokol  person- 
nel. Lovingood  called  Stanley  Reinartz,  Shuttle 
Project  Manager,  a  few  minutes  later  and  in- 
formed him  of  the  planned  telecon. 

The  first  phase  of  the  teleconference  began  at 
5:45  p.m.  Eastern  Standard  Time;  participants 
included  Reinartz,  Lovingood,  Hardy,  and 
numerous  people  at  Kennedy,  Marshall  and 
Thiokol- Wasatch.  (Allan  McDonald  missed  this 
phase;  he  did  not  arrive  at  Kennedy  until  after 
8:00  p.m.)  Concerns  for  the  effect  of  low 
temperature  on  the  O-rings  and  the  joint  seal 
were  presented  by  Morton  Thiokol,  along  with 
an  opinion  that  launch  should  be  delayed.  A 
recommendation  was  also  made  that  Aldrich, 
Program  Manager  at  Johnson  (Level  II),  be  in- 
formed of  these  concerns. 

The  following  are  excerpts  from  testimony 
before  the  Commission  relating  to  the 
teleconference:8 

Dr.  Keel:  You  just  indicated  earlier  that, 
based  upon  that  teleconference,  you  thought 
there  was  a  good  possibility  of  delay.  Is  that 
what  Thiokol  was  recommending  then,  was 
delay? 

Dr.  Lovingood:  That  is  the  way  I  heard  it, 
and  they  were  talking  about  the  51-C  ex- 
perience and  the  fact  that  they  had  ex- 
perienced the  worst  case  blow-by  as  far  as 
the  arc  and  the  soot  and  so  forth.  And  also, 
they  talked  about  the  resiliency  data  that 
they  had. 

So  it  appeared  to  me  — and  we  didn't  have 
all  of  the  proper  people  there.  That  was 
another  aspect  of  this.  It  appeared  to  me  that 
we  had  better  sit  down  and  get  the  data  so 
that  we  could  understand  exactly  what  they 
were  talking  about  and  assess  that  data. 

And  that  is  why  I  suggested  that  we  go 
ahead  and  have  a  telecon  within  the  center, 
so  that  we  could  review  that. 


Dr.  Keel:  So  as  early  as  after  that  first  after- 
noon conference  at  5:45,  it  appeared  that 
Thiokol  was  basically  saying  delay.  Is  that 
right? 

Dr.  Lovingood:  That  is  the  way  it  came 
across  to  me.  I  don't  know  how  other  peo- 
ple perceived  it,  but  that's  the  way  it  came 
across  to  me. 

Dr.  Keel:  Mr.  Reinartz,  how  did  you 
perceive  it? 

Mr.  Reinartz:  I  did  not  perceive  it  that  way. 
I  perceived  that  they  were  raising  some  ques- 
tions and  issues  which  required  looking  in- 
to by  all  the  right  parties,  but  I  did  not 
perceive  it  as  a  recommendation  delay. 

Dr.  Keel:  Some  prospects  for  delay? 

Mr.  Reinartz:  Yes,  sir,  that  possibility  is 
always  there. 

Dr.  Keel:  Did  you  convey  that  to  Mr. 
Mulloy  and  Mr.  Hardy  before  the  8:15 
conference? 

Mr.  Reinartz:  Yes,  I  did.  And  as  a  matter 
of  fact,  we  had  a  discussion.  Mr.  Mulloy  was 
just  out  of  communication  for  about  an 
hour,  and  then  after  that  I  got  in  contact  with 
him,  and  we  both  had  a  short  discussion 
relating  to  the  general  nature  of  the  concerns 
with  Dr.  Lucas  and  Mr.  Kingsbury  at  the 
motel  before  we  both  departed  for  the  telecon 
that  we  had  set  up  out  at  the  Cape. 

Dr.  Keel:  But  based  upon  that,  Mr.  Lov- 
ingood, that  impression,  you  thought  it  was 
a  significant  enough  possibility  that  Mr. 
Aldrich  should  have  been  contacted? 

Dr.  Lovingood:  Yes. 

Dr.  Keel:  In  addition,  did  you  recommend 
that  Mr.  Lucas,  who  is  director  of  Marshall, 
of  course,  and  Mr.  Kingsbury,  who  is  Mr. 
Hardy's  boss,  participate  in  the  8:15 
conference? 

Dr.  Lovingood:  Yes,  I  did. 

Dr.  Keel:  And  you  recommended  that  to 
whom? 

Dr.  Lovingood:  I  believe  I  said  that  over 
the  net.  I  said  that  I  thought  we  ought  to 
have  an  inter-center  meeting  involving  Dr. 
Lucas  and  Mr.  Kingsbury,  and  then  plan 
to  go  on  up  the  line  to  Level  II  and  Level  I. 
And  then  it  was  after  we  broke  off  that  first 
telecon  I  called  Stan  at  the  motel  and  told 
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him  that  he  ought  to  go  ahead  and  alert 
Arnie  to  that  possibility. 

Dr.  Keel:  And  Mr.  Reinartz,  you  then 
visited  the  motel  room  of  Mr.  Lucas  with 
Mr.  Kingsbury,  and  also  was  Mr.  Mulloy 
with  you  then? 

Mr.  Reinartz:  Yes,  sir,  he  was.  In  the  first 
couple  of  minutes  I  believe  I  was  there  by 
myself,  and  then  Mr.  Mulloy  joined  us. 

Dr.  Keel:  And  did  you  discuss  with  them 
Mr.  Lovingood's  recommendation  that  the 
two  of  them,  Lucas  and  Kingsbury, 
participate? 

Mr.  Reinartz:  No,  sir.  I  don't  recall  discuss- 
ing Mr.  Lovingood's  recommendations.  I 
discussed  with  them  the  nature  of  the 
telecon,  the  nature  of  the  concerns  raised  by 
Thiokol,  and  the  plans  to  gather  the  proper 
technical  support  people  at  Marshall  for  ex- 
amination of  the  data.  And  I  believe  that  was 
the  essence  of  the  discussion. 

Chairman  Rogers:  But  you  didn't  recom- 
mend that  the  information  be  given  to  Level 
II  or  Level  I? 

Mr.  Reinartz:  I  don't  recall  that  I  raised  that 
issue  with  Dr.  Lucas.  I  told  him  what  the 
plans  were  for  proceeding.  I  don't  recall,  Mr. 
Chairman,  making  any  statement  regarding 
that. 

Mr.  Hotz:  Mr.  Reinartz,  are  you  telling  us 
that  you  in  fact  are  the  person  who  made  the 
decision  not  to  escalate  this  to  a  Level  II 
item? 

Mr.  Reinartz:  That  is  correct,  sir. 

At  approximately  8:45  p.m.  Eastern  Standard 
Time,  Phase  2  of  the  teleconference  commenc- 
ed, the  Thiokol  charts  and  written  data  having 
arrived  at  Kennedy  Space  Center  by  telefax.  (A 
table  of  teleconference  participants  is  included 
with  Chronology  of  Events.)  The  charts  presented 
a  history  of  the  O-ring  erosion  and  blow-by  in 
the  Solid  Rocket  Booster  joints  of  previous  flights, 
presented  the  results  of  subscale  testing  at  Thiokol 
and  the  results  of  static  tests  of  Solid  Rocket 
Motors.  In  the  following  testimony,  Roger  Bois- 
joly,  Allan  McDonald  and  Larry  Mulloy  ex- 
pressed their  recollections  of  this  teleconference 
up  to  the  point  when  an  off-net  caucus  was 
requested:9 


Mr.  Boisjoly:  I  expressed  deep  concern 
about  launching  at  low  temperature.  I 
presented  Chart  2-1  with  emphasis  — now, 
2-1,  if  you  want  to  see  it,  I  have  it,  but 
basically  that  was  the  chart  that  summariz- 
ed the  primary  concerns,  and  that  was  the 
chart  that  I  pulled  right  out  of  the 
Washington  presentation  without  changing 
one  word  of  it  because  it  was  still  applicable, 
and  it  addresses  the  highest  concern  of  the 
field  joint  in  both  the  ignition  transient  con- 
dition and  the  steady  state  condition,  and  it 
really  sets  down  the  rationale  for  why  we 
were  continuing  to  fly.  Basically,  if  erosion 
penetrates  the  primary  O-ring  seal,  there  is 
a  higher  probability  of  no  secondary  seal 
capability  in  the  steady  state  condition.  And 
I  had  two  sub-bullets  under  that  which  stated 
bench  testing  showed  O-ring  not  capable  of 
maintaining  contact  with  metal  parts,  gap, 
opening  rate  to  maximum  operating 
pressure.  I  had  another  bullet  which  stated 
bench  testing  showed  capability  to  maintain 
O-ring  contact  during  initial  phase  (0  to  170 
milliseconds  of  transient).  That  was  my  com- 
fort basis  of  continuing  to  fly  under  normal 
circumstances,  normal  being  within  the  data 
base  we  had. 

I  emphasized,  when  I  presented  that  chart 
about  the  changing  of  the  timing  function 
of  the  O-ring  as  it  attempted  to  seal.  I  was 
concerned  that  we  may  go  from  that  first 
beginning  region  into  that  intermediate 
region,  from  0  to  170  being  the  first  region, 
and  170  to  330  being  the  intermediate  region 
where  we  didn't  have  a  high  probability  of 
sealing  or  seating. 

I  then  presented  Chart  2-2  with  added 
concerns  related  to  the  timing  function.  And 
basically  on  that  chart,  I  started  off  talking 
about  a  lower  temperature  than  current  data 
base  results  in  changing  the  primary  O-ring 
sealing  timing  function,  and  I  discussed  the 
SRM-15  [Flight  51-C,  January,  1985]  obser- 
vations, namely,  the  15A  [Left  SRM,  Flight 
51-C]  motor  had  80  degrees  arc  black  grease 
between  the  O-rings,  and  make  no  mistake 
about  it,  when  I  say  black,  I  mean  black  just 
like  coal.  It  was  jet  black.  And  SRM-15B 
[Right  SRM,  Flight  51-C]  had  a  1 10  degree 
arc  of  black  grease  between  the  O-rings.  We 
would  have  low  O-ring  squeeze  due  to  low 
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PRIMARY  CONCERNS 

FIELD  JOINT  -  HIGHEST  CONCERN 

o      EROSION  PENETRATION  OF  PRIMARY  SEAL  REQUIRES  RELIABLE  SECONDARY  SEAL 

FOR  PRESSURE  INTEGRITY 

o      IGNITION  TRANSIENT  -  (0-600  MS) 

o      (0-170  IEJKIGH  PROBABILITY  OF  RELIABLE  SECONDARY  SEAL 

o      (170-130  MS)  REDUCED  PROBABILITY  OF  RELIABLE  SECONDARY  SEAL 

0    (530-600  US)  HIGH  PROBABILITY  OF  NO  SECONDARY  SEAL  CAPABILITY 

0      STEADY  STATE  -  (600  MS  -  2  MINUTES) 

o      IF  EROSION  PENETRATES  PRIMARY  0-R1NG  SEAL  -  HIGH  PROBABILITY  OF 
NO  SECONDARY  SEAL  CAPABILITY 
o      BENCH  TESTING  SHOHED  O-RING  NOT  CAPABLE  OF  MAIIITATNIHG  CONTACT 

H1TH  METAL  PARTS  GAP  OPENING  RATE  TO  tEOP 
o      BENCH  TESTING  SP£WED  CAPABILITY  TO  KAINTAIN  O-RING  CONTACT  DURING 
INITIAL  PHASE  (0-170  IIS)  OF  TRANSIENT 


Chart  2-1  presented  by  Thiokol's  Roger  Boisjoly  summarizing 
primary  concerns  with  the  field  pint  and  its  0-rmg  seals  on  the 
boosters. 


Joint  Primary  Concerns 


SRM25 


■  A  Temperature  Lower  Than  Current  Data  Base 
Results  in  Changing  Primary  0-Rmg  Sealing  Timing 
Function 

■  SRM  15A-800  ARC  Black  Grease  Between 
O-Rmgs 

SRM  15B—  1 10°  ARC  Black  Grease  Between 
O-Rmgs 

■  Lower  O-Ring  squeeze  due  to  lower  temp. 

■  Higher  O-Ring  shore  hardness 

■  Thicker  grease  viscosity 

■  Higher  0-Rmg  pressure  actuation  time 

■  If  actuation  time  increases,  threshold  of  secondary 
seal  pressurization  capability  is  approached 

■  If  threshold  is  reached  then  secondary  seal  may  not 
be  capable  of  being  pressurized 


Boisjoly's  Chart  2-2  indicating  concern  about  temperature  ef- 
fect on  seal  actuation  time  (handwritten). 


temperature  which  I  calculated  earlier  in  the 
day.  We  should  have  higher  O-ring  Shore 
hardness.  .  .  . 

Now,  that  would  be  harder.  And  what 
that  material  really  is,  it  would  be  likened 
to  trying  to  shove  a  brick  into  a  crack  ver- 
sus a  sponge.  That  is  a  good  analogy  for  pur- 
poses of  this  discussion.  I  also  mentioned 
that  thicker  grease,  as  a  result  of  lower 
temperatures,  would  have  a  higher  viscosi- 
ty. It  wouldn't  be  as  slick  and  slippery  as  it 
would  be  at  room  temperature.  And  so  it 
would  be  a  little  bit  more  difficult  to  move 
across  it. 

We  would  have  higher  O-ring  pressure  ac- 
tuation time,  in  my  opinion,  and  that  is  what 
I  presented.  .  .  .  These  are  the  sum  and 
substance  of  what  I  just  presented.  If  action 
time  increases,  then  the  threshold  of  second- 
ary seal  pressurization  capability  is  ap- 
proached. That  was  my  fear.  If  the  threshold 
is  reached,  then  secondary  seal  may  not  be 
capable  of  being  pressurized,  and  that  was 
the  bottom  line  of  everything  that  had  been 
presented  up  to  that  point. 
Chairman  Rogers:  Did  anybody  take  issue 
with  you? 

Mr.  Boisjoly:  Well,  I  am  coming  to  that. 
I  also  showed  a  chart  of  the  joint  with  an 
exaggerated  cross  section  to  show  the  seal 


lifted  off,  which  has  been  shown  to 
everybody.  I  was  asked,  yes,  at  that  point 
in  time  I  was  asked  to  quantify  my  concerns, 
and  I  said  I  couldn't.  I  couldn't  quantify  it. 
I  had  no  data  to  quantify  it,  but  I  did  say 
I  knew  that  it  was  away  from  goodness  in 
the  current  data  base.  Someone  on  the  net 
commented  that  we  had  soot  blow-by  on 
SRM-22  [Flight  61-A,  October,  1985] 
which  was  launched  at  75  degrees.  I  don't 
remember  who  made  the  comment,  but  that 
is  where  the  first  comment  came  in  about 
the  disparity  between  my  conclusion  and  the 
observed  data  because  SRM-22  [Flight 
61-A,  October,  1985]  had  blow-by  at  essen- 
tially a  room  temperature  launch. 

I  then  said  that  SRM- 15  [Flight  51-C, 
January,  1985]  had  much  more  blow-by  in- 
dication and  that  it  was  indeed  telling  us  that 
lower  temperature  was  a  factor.  This  was 
supported  by  inspection  of  flown  hardware 
by  myself.  I  was  asked  again  for  data  to  sup- 
port my  claim,  and  I  said  I  have  none  other 
than  what  is  being  presented,  and  I  had  been 
trying  to  get  resilience  data,  Arnie  and  I 
both,  since  last  October,  and  that  statement 
was  mentioned  on  the  net. 

Others  in  the  room  presented  their  charts, 
and  the  main  telecon  session  concluded  with 
Bob  Lund,  who  is  our  Vice  President  of 
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Initial  Thiokol  recommendation  Chart  presented  by  Robert  K. 
Lund  at  second  teleconference  prior  to  Thiokol  caucus. 

Engineering,  presenting  his  conclusions  and 
recommendations  charts  which  were  based 
on  our  data  input  up  to  that  point.  Listeners 
on  the  telecon  were  not  pleased  with  the  con- 
clusions and  the  recommendations. 
Chairman  Rogers:  What  was  the 
conclusion? 

Mr.  Boisjoly:  The  conclusion  was  we 
should  not  fly  outside  of  our  data  base,  which 
was  53  degrees.  Those  were  the  conclusions. 
And  we  were  quite  pleased  because  we  knew 
in  advance,  having  participated  in  the 
preparation,  what  the  conclusions  were,  and 
we  felt  very  comfortable  with  that. 
Mr.  Acheson:  Who  presented  that 
conclusion? 

Mr.  Boisjoly:  Mr.  Bob  Lund.  He  had 
prepared  those  charts.  He  had  input  from 
other  people.  He  had  actually  physically 
prepared  the  charts.  It  was  about  that  time 
that  Mr.  Hardy  from  Marshall  was  asked 
what  he  thought  about  the  MTI  [Morton 
Thiokol]  recommendation,  and  he  said  he 
was  appalled  at  the  MTI  decision.  Mr.  Har- 
dy was  also  asked  about  launching,  and  he 
said  no,  not  if  the  contractor  recommended 
not  launching,  he  would  not  go  against  the 
contractor  and  launch. 

There  was  a  short  discussion  that  ensued 
about  temperature  not  being  a  discriminator 
between  SRM-15  [Flight  51-C]  and 
SRM-22  [Flight  61 -A],  and  shortly  after,  I 
believe  it  was  Mr.  Kilminster  asked  if— 
excuse  me.  I'm  getting  confused  here.  Mr. 
Kilminster  was  asked  by  NASA  if  he  would 
launch,  and  he  said  no  because  the  engineer- 
ing recommendation  was  not  to  launch. 


Then  MTI  management  then  asked  for 
a  five-minute  caucus.  I'm  not  sure  exactly 
who  asked  for  that,  but  it  was  asked  in  such 
a  manner  that  I  remember  it  was  asked  for, 
a  five-minute  caucus,  which  we  put  on  — 
the  line  on  mute  and  went  off-line  with  the 
rest  of  the  net. 

Chairman  Rogers:  Mr.  Boisjoly,  at  the  time 
that  you  made  the  — that  Thiokol  made  the 
recommendation  not  to  launch,  was  that  the 
unanimous  recommendation  as  far  as  you 
knew? 

Mr.  Boisjoly:  Yes.  I  have  to  make 
something  clear.  I  have  been  distressed  by 
the  things  that  have  been  appearing  in  the 
paper  and  things  that  have  been  said  in 
general,  and  there  was  never  one  positive, 
pro-launch  statement  ever  made  by  any- 
body. There  have  been  some  feelings  since 
then  that  folks  have  expressed  that  they 
would  support  the  decision,  but  there  was 
not  one  positive  statement  for  launch  ever 
made  in  that  room. 

Mr.  McDonald's  testimony:10 

Mr.  McDonald:  I  arrived  at  the  Kennedy 
Space  Center  at  about  8:15  [p.m.],  and 
when  I  arrived  there  at  the  Kennedy  Space 
Center  the  others  that  had  already  arrived 
were  Larry  Mulloy,  who  was  there  — he  is 
the  manager,  the  project  manager  for  the 
SRB  for  Marshall.  Stan  Reinartz  was  there 
and  he  is  the  manager  of  the  Shuttle  Project 
Office.  He's  Larry  Mulloy's  boss. 

Cecil  Houston  was  there,  the  resident 
manager  for  Marshall.  And  Jack  Buchanan 
was  there.  He  happens  to  be  our  manager, 
Morton  Thiokol's  manager  of  our  launch 
support  services  office  at  Kennedy. 

The  telecon  hadn't  started  vet.  It  came  on 
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the  network  shortly  after  I  got  there.  .  .  . 
Chairman  Rogers:  Was  it  essentially  a 
telephone  conference  or  was  there  actually 
a  network  of  pictures? 

Mr.  McDonald:  It  was  a  telephone  con- 
ference. .  .  . 

But  I  will  relay  .  .  .  what  I  heard  at  the 
conference  as  best  I  can.  The  teleconference 
started  I  guess  close  to  9:00  o'clock  and,  even 
though  all  the  charts  weren't  there,  we  were 
told  to  begin  and  that  Morton  Thiokol 
should  take  the  lead  and  go  through  the 
charts  that  they  had  sent  to  both  centers. 

The  charts  were  presented  by  the 
engineering  people  from  Thiokol,  in  fact  by 
the  people  that  had  made  those  particular 
charts.  Some  of  them  were  typed,  some  of 
them  were  handwritten.  And  they  discuss- 
ed their  concerns  with  the  low  temperatures 
relative  to  the  possible  effects  on  the  O-rings, 
primarily  the  timing  function  to  seal  the  O- 
rings. 

They  presented  a  history  of  some  of  the 
data  that  we  had  accumulated  both  in  static 
test  and  in  flight  tests  relative  to 
temperatures  and  the  performance  of  the  O- 
rings,  and  reviewed  the  history  of  all  of  our 
erosion  studies  of  the  O-rings,  in  the  field 
joints,  any  blow-by  of  the  primary  O-ring 
with  soot  or  products  of  combustion  or 
decomposition  that  we  had  noted,  and  the 
performance  of  the  secondary  O-rings. 

And  there  was  an  exchange  amongst  the 
technical  people  on  that  data  as  to  what  it 
meant  .  .  .  But  the  real  exchange  never  real- 
ly came  until  the  conclusions  and  recommen- 
dations came  in. 

At  that  point  in  time,  our  vice  president, 
Mr.  Bob  Lund,  presented  those  charts  and 
he  presented  the  charts  on  the  conclusions 
and  recommendations.  And  the  bottom  line 
was  that  the  engineering  people  would  not 
recommend  a  launch  below  53  degrees 
Fahrenheit.  The  basis  for  that  recommen- 
dation was  primarily  our  concern  with  the 
launch  that  had  occurred  about  a  year 
earlier,  in  January  of  1985,  I  believe  it  was 
51-C. 

Mr.  Mulloy's  testimony:11 

Mr.  Mulloy:  That  telecon  was  a  little  late 
starting.  It  was  intended  to  be  set  up  at  8: 15 


.  .  .  and  the  telecon  was  begun  at  8:45. 

And  Thiokol  will  then  present  to  you  to- 
day the  data  that  they  presented  to  us  in  that 
telecon.  I  will  not  do  that.  The  bottom  line 
of  that,  though,  initially  was  that  Thiokol 
engineering,  Bob  Lund,  who  is  the  Vice 
President  and  Director  of  Engineering,  who 
is  here  today,  recommended  that  51-L  not 
be  launched  if  the  O-ring  temperatures 
predicted  at  launch  time  would  be  lower  than 
any  previous  launch,  and  that  was  53 
degrees. 

Dr.  Walker:  May  I  ask  a  question?  I  wish 
you  would  distinguish  between  the  predicted 
bulk  temperatures  and  the  O-ring 
temperatures.  In  fact,  as  I  understand  it,  you 
really  don't  have  any  official  O-ring 
temperature  prediction  in  your  models,  and 
it  seems  that  the  assumption  has  been  that 
the  O-ring  temperature  is  the  same  as  the 
bulk  temperature,  which  we  know  is  not  the 
case. 

Mr.  Mulloy:  You  will  see,  sir,  in  the 
Thiokol  presentation  today  that  that  is  not 
the  case.  This  was  a  specific  calculation  of 
what  the  O-ring  temperature  was  on  the  day 
of  the  January  1985  launch.  It  is  not  the  bulk 
temperature  of  the  propellant,  nor  is  it  the 
ambient  temperature  of  the  air. 

It  was  Thiokol's  calculation  of  what  the 
lowest  temperature  an  O-ring  had  seen  in 
previous  flights,  and  the  engineering  recom- 
mendation was  that  we  should  not  move  out- 
side of  that  experience  base. 

I  asked  Joe  Kilminster,  who  is  the  pro- 
gram manager  for  the  booster  program  at 
Thiokol,  what  his  recommendation  was, 
because  he  is  the  gentleman  that  I  get  my 
recommendations  from  in  the  program  of- 
fice. He  stated  that,  based  on  that  engineer- 
ing recommendation,  that  he  could  not 
recommend  launch. 

At  that  point  I  restated,  as  I  have  testified 
to,  the  rationale  that  was  essentially 
documented  in  the  1982  Critical  Items  List, 
that  stated  that  the  rationale  had  been  that 
we  were  flying  with  a  simplex  joint  seal.  And 
you  will  see  in  the  Thiokol  presentation  that 
the  context  of  their  presentation  is  that  the 
primary  ring,  with  the  reduced  temperatures 
and  reduced  resiliency,  may  not  function  as 
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a  primary  seal  and  we  would  be  relying  on 
secondary. 

And  without  getting  into  their  rationale 
and  getting  ahead,  the  point,  the  bottom 
line,  is  that  we  were  continuing  — the  assess- 
ment was,  my  assessment  at  that  time  was, 
that  we  would  have  an  effective  simplex  seal, 
based  upon  the  engineering  data  that 
Thiokol  had  presented,  and  that  none  of 
those  engineering  data  seemed  to  change 
that  basic  rationale. 

Stan  Reinartz  then  asked  George  Hardy, 
the  Deputy  Director  of  Science  and 
Engineering  at  Marshall,  what  his  opinion 
was.  George  stated  that  he  agreed  that  the 
engineering  data  did  not  seem  to  change  this 
basic  rationale,  but  also  stated  on  the  telecon 
that  he  certainly  would  not  recommend 
launching  if  Thiokol  did  not. 

At  that  time  Joe  Kilminster  requested  a 
five  minute  off-net  caucus,  and  that  caucus 
lasted  approximately  30  minutes. 

The  teleconference  was  recessed  at  approx- 
imately 10:30  p.m.  Eastern  Standard  Time.  The 
off-net  caucus  of  Thiokol  personnel  started  and 
continued  for  about  30  minutes  at  the  Wasatch 
office.  The  major  issues,  according  to  the 
testimony  of  Jerry  Mason,  Senior  Vice  President 
for  Wasatch  Operations,  were  the  effect  of 
temperature  upon  the  O-rings  and  the  history  of 
erosion  of  the  O-rings:12 

Mr.  Mason:  Now,  in  the  caucus  we 
revisited  all  of  our  previous  discussions,  and 
the  important  things  that  came  out  of  that 
was  that,  as  we  had  recognized,  we  did  have 
the  possibility  that  the  primary  O-ring  might 
be  slower  to  move  into  the  seating  position 
and  that  was  our  concern,  and  that  is  what 
we  had  focused  on  originally. 

The  fact  that  we  couldn't  show  direct  cor- 
relation with  the  O-ring  temperature  was 
discussed,  but  we  still  felt  that  there  was 
some  concern  about  it  being  colder. 

We  then  recognized  that,  if  the  primary- 
did  move  more  slowly,  that  we  could  get 
some  blow-by  and  erosion  on  the  primary. 
But  we  had  pointed  out  to  us  in  that  caucus 
a  point  that  had  not  come  across  clearly  in 
our  earlier  discussions,  and  that  is  that  we 
had  run  tests  where  we  deliberately  cut  large 
pieces  out  of  the  O-rings  to  see  what  the 
threshold  of  sealing  was,  and  we  found  we 
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could  go  to  125  thousandths  of  a  cut  out  of 
the  O-ring  and  it  would  still  seal. 

Approximately  10  engineers  participated  in  the 
caucus,  along  with  Mason,  Kilminster,  C.  G. 
Wiggins  (Vice  President,  Space  Division),  and 
Lund.  Arnold  Thompson  and  Boisjoly  voiced 
very  strong  objections  to  launch,  and  the  sugges- 
tion in  their  testimony  was  that  Lund  was  also 
reluctant  to  launch:13 

Mr.  Boisjoly:  Okay,  the  caucus  started  by 
Mr.  Mason  stating  a  management  decision 
was  necessary.  Those  of  us  who  opposed  the 
launch  continued  to  speak  out,  and  I  am 
specifically  speaking  of  Mr.  Thompson  and 
myself  because  in  my  recollection  he  and  I 
were  the  only  ones  that  vigorously  continued 
to  oppose  the  launch.  And  we  were  attempt- 
ing to  go  back  and  rereview  and  try  to  make 
clear  what  we  were  trying  to  get  across,  and 
we  couldn't  understand  why  it  was  going  to 
be  reversed.  So  we  spoke  out  and  tried  to 
explain  once  again  the  effects  of  low 
temperature.  Arnie  actually  got  up  from  his 
position  which  was  down  the  table,  and 
walked  up  the  table  and  put  a  quarter  pad 
down  in  front  of  the  table,  in  front  of  the 
management  folks,  and  tried  to  sketch  out 
once  again  what  his  concern  was  with  the 
joint,  and  when  he  realized  he  wasn't  get- 
ting through,  he  just  stopped. 

I  tried  one  more  time  with  the  photos.  I 
grabbed  the  photos,  and  I  went  up  and 
discussed  the  photos  once  again  and  tried  to 
make  the  point  that  it  was  my  opinion  from 
actual  observations  that  temperature  was  in- 
deed a  discriminator  and  we  should  not  ig- 
nore the  physical  evidence  that  we  had 
observed. 

And  again,  I  brought  up  the  point  that 
SRM-15  [Flight  51-C,  January,  1985]  had 
a  110  degree  arc  of  black  grease  while 
SRM-22  [Flight  61-A,  October,  1985]  had 
a  relatively  different  amount,  which  was  less 
and  wasn't  quite  as  black.  I  also  stopped 
when  it  was  apparent  that  I  couldn't  get 
anybody  to  listen. 

Dr.  Walker:  At  this  point  did  anyone  else 
speak  up  in  favor  of  the  launch? 
Mr.  Boisjoly:  No,  sir.  No  one  said 
anything,  in  my  recollection,  nobody  said 
a  word.  It  was  then  being  discussed  amongst 
the  management  folks.  After  Arnie  and  I  had 


our  last  say,  Mr.  Mason  said  we  have  to 
make  a  management  decision.  He  turned  to 
Bob  Lund  and  asked  him  to  take  off  his 
engineering  hat  and  put  on  his  management 
hat.  From  this  point  on,  management  for- 
mulated the  points  to  base  their  decision  on. 
There  was  never  one  comment  in  favor,  as 
I  have  said,  of  launching  by  any  engineer 
or  other  nonmanagement  person  in  the  room 
before  or  after  the  caucus.  I  was  not  even 
asked  to  participate  in  giving  any  input  to 
the  final  decision  charts. 

I  went  back  on  the  net  with  the  final  charts 
or  final  chart,  which  was  the  rationale  for 
launching,  and  that  was  presented  by  Mr. 
Kilminster.  It  was  hand  written  on  a 
notepad,  and  he  read  from  that  notepad.  I 
did  not  agree  with  some  of  the  statements 
that  were  being  made  to  support  the  deci- 
sion. I  was  never  asked  nor  polled,  and  it 
was  clearly  a  management  decision  from  that 
point. 

I  must  emphasize,  I  had  my  say,  and  I 
never  [would]  take  [away]  any  management 
right  to  take  the  input  of  an  engineer  and 
then  make  a  decision  based  upon  that  input, 
and  I  truly  believe  that.  I  have  worked  at 
a  lot  of  companies,  and  that  has  been  done 
from  time  to  time,  and  I  truly  believe  that, 
and  so  there  was  no  point  in  me  doing 
anything  any  further  than  I  had  already  at- 
tempted to  do. 

I  did  not  see  the  final  version  of  the  chart 
until  the  next  day.  I  just  heard  it  read.  I  left 
the  room  feeling  badly  defeated,  but  I  felt 
I  really  did  all  I  could  to  stop  the  launch. 

I  felt  personally  that  management  was 
under  a  lot  of  pressure  to  launch  and  that 
they  made  a  very  tough  decision,  but  I  didn't 
agree  with  it. 

One  of  my  colleagues  that  was  in  the 
meeting  summed  it  up  best.  This  was  a 
meeting  where  the  determination  was  to 
launch,  and  it  was  up  to  us  to  prove  beyond 
a  shadow  of  a  doubt  that  it  was  not  safe  to 
do  so.  This  is  in  total  reverse  to  what  the 
position  usually  is  in  a  preflight  conversa- 
tion or  a  flight  readiness  review.  It  is  usual- 
ly exactly  opposite  that. 

Dr.  Walker:  Do  you  know  the  source  of  the 
pressure  on  management  that  you  alluded 
to? 


Mr.  Boisjoly:  Well,  the  comments  made 
over  the  [net]  is  what  I  felt,  I  can't  speak  for 
them,  but  I  felt  it  — I  felt  the  tone  of  the 
meeting  exactly  as  I  summed  up,  that  we 
were  being  put  in  a  position  to  prove  that 
we  should  not  launch  rather  than  being  put 
in  the  position  and  prove  that  we  had  enough 
data  to  launch.  And  I  felt  that  very  real. 
Dr.  Walker:  These  were  the  comments  from 
the  NASA  people  at  Marshall  and  at  Ken- 
nedy Space  Center? 
Mr.  Boisjoly:  Yes. 

Dr.  Feynman:  I  take  it  you  were  trying  to 
find  proof  that  the  seal  would  fail? 
Mr.  Boisjoly:  Yes. 

Dr.  Feynman:  And  of  course,  you  didn't, 
you  couldn't,  because  five  of  them  didn't, 
and  if  you  had  proved  that  they  would  have 
all  failed,  you  would  have  found  yourself  in- 
correct because  five  of  them  didn't  fail. 
Mr.  Boisjoly:  That  is  right.  I  was  very  con- 
cerned that  the  cold  temperatures  would 
change  that  timing  and  put  us  in  another 
regime,  and  that  was  the  whole  basis  of  my 
fighting  that  night. 

As  appears  from  the  foregoing,  after  the  discus- 
sion between  Morton  Thiokol  management  and 
the  engineers,  a  final  management  review  was 
conducted  by  Mason,  Lund,  Kilminster,  and 
Wiggins.  Lund  and  Mason  recall  this  review  as 
an  unemotional,  rational  discussion  of  the 
engineering  facts  as  they  knew  them  at  that  time; 
differences  of  opinion  as  to  the  impact  of  those 
facts,  however,  had  to  be  resolved  as  a  judgment 
call  and  therefore  a  management  decision.  The 
testimony  of  Lund  taken  by  Commission  staff  in- 
vestigators is  as  follows:14 

Mr.  Lund:  We  tried  to  have  the  telecon,  as 
I  remember  it  was  about  6:00  o'clock 
[MST],  but  we  didn't  quite  get  things  in 
order,  and  we  started  transmitting  charts 
down  to  Marshall  around  6:00  or  6:30 
[MST],  something  like  that,  and  we  were 
making  charts  in  real  time  and  seeing  the 
data,  and  we  were  discussing  them  with  the 
Marshall  folks  who  went  along. 

We  finally  got  the  — all  the  charts  in,  and 
when  we  got  all  the  charts  in  I  stood  at  the 
board  and  tried  to  draw  the  conclusions  that 
we  had  out  of  the  charts  that  had  been 
presented,  and  we  came  up  with  a  conclu- 
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sions  chart  and  said  that  we  didn't  feel  like 

it  was  a  wise  thing  to  fly. 

Question:     What    were    some    of    the 

conclusions? 

Mr.  Lund:  I  had  better  look  at  the  chart. 

Well,  we  were  concerned  the  temperature 
was  going  to  be  lower  than  the  50  or  the  53 
that  had  flown  the  previous  January,  and  we 
had  experienced  some  blow-by,  and  so  we 
were  concerned  about  that,  and  although  the 
erosion  on  the  O-rings,  and  it  wasn't  critical, 
that,  you  know,  there  had  obviously  been 
some  little  puff  go  through.  It  had  been 
caught. 

There  was  no  real  extensive  erosion  of  that 
O-ring,  so  it  wasn't  a  major  concern,  but  we 
said,  gee,  you  know,  we  just  don't  know  how 
much  further  we  can  go  below  the  51  or  53 
degrees  or  whatever  it  was.  So  we  were  con- 
cerned with  the  unknown.  And  we  presented 
that  to  Marshall,  and  that  rationale  was  re- 
jected. They  said  that  they  didn't  accept  that 
rationale,  and  they  would  like  us  to  consider 
some  other  thoughts  that  they  had  had. 

.  .  .  Mr.  Mulloy  said  he  did  not  accept 
that,  and  Mr.  Hardy  said  he  was  appalled 
that  we  would  make  such  a  recommenda- 
tion. And  that  made  me  ponder  of  what  I'd 
missed,  and  so  we  said,  what  did  we  miss, 
and  Mr.  Mulloy  said,  well,  I  would  like  you 
to  consider  these  other  thoughts  that  we  have 
had  down  here.  And  he  presented  a  very 
strong  and  forthright  rationale  of  what  they 
thought  was  going  on  in  that  joint  and  how 
they  thought  that  the  thing  was  happening, 
and  they  said,  we'd  like  you  to  consider  that 
when  they  had  some  thoughts  that  we  had 
not  considered. 

...  So  after  the  discussion  with  Mr. 
Mulloy,  and  he  presented  that,  we  said,  well, 
let's  ponder  that  a  little  bit,  so  we  went  off- 
line to  talk  about  what  we  — 
Question:  Who  requested  to  go  off-line? 
Mr.  Lund:  I  guess  it  was  Joe  Kil- 
minster.  .  .  . 

And  so  we  went  offline  on  the  telecon  .  .  . 
so  we  could  have  a  roundtable  discussion 
here. 

Question:  Who  were  the  management  peo- 
ple that  were  there? 

Mr.  Lund:  Jerry  Mason,  Cal  Wiggins,  Joe, 
I.    manager    of   engineering    design,    the 


manager   of  applied    mechanics.    On    the 
chart. 

Before  the  Commission  on  February  25,  1986, 
Mr.  Lund  testified  as  follows  regarding  why  he 
changed  his  position  on  launching  Challenger 
during  the  management  caucus  when  he  was 
asked  by  Mr.  Mason  "To  take  off  his  engineer- 
ing hat  and  put  on  his  management  hat":15 

Chairman  Rogers:  How  do  you  explain  the 
fact  that  you  seemed  to  change  your  mind 
when  you  changed  your  hat? 
Mr.  Lund:  I  guess  we  have  got  to  go  back 
a  little  further  in  the  conversation  than  that. 
We  have  dealt  with  Marshall  for  a  long  time 
and  have  always  been  in  the  position  of 
defending  our  position  to  make  sure  that  we 
were  ready  to  fly,  and  I  guess  I  didn't  realize 
until  after  that  meeting  and  after  several  days 
that  we  had  absolutely  changed  our  position 
from  what  we  had  been  before.  But  that 
evening  I  guess  I  had  never  had  those  kinds 
of  things  come  from  the  people  at  Marshall. 
We  had  to  prove  to  them  that  we  weren't 
ready,  and  so  we  got  ourselves  in  the  thought 
process  that  we  were  trying  to  find  some  way 
to  prove  to  them  it  wouldn't  work,  and  we 
were  unable  to  do  that.  We  couldn't  prove 
absolutely  that  that  motor  wouldn't  work. 
Chairman  Rogers:  In  other  words,  you 
honestly  believed  that  you  had  a  duty  to 
prove  that  it  would  not  work? 
Mr.  Lund:  Well,  that  is  kind  of  the  mode 
we  got  ourselves  into  that  evening.  It  seems 
like  we  have  always  been  in  the  opposite 
mode.  I  should  have  detected  that,  but  I  did 
not,  but  the  roles  kind  of  switched.  .  .  . 

Supplemental  testimony  of  Mr.  Mason  ob- 
tained in  a  Commission  staff  interview  is  as 
follows:16 

Question:  Do  you  recall  Mr.  Hardy  and 
Mr.  Mulloy's  comments  after  — I  think  after 
Mr.  Kilminster  had  got  done,  or  Mr.  Lund 
got  done  presenting  the  charts?  They  had 
some  comments.  Do  you  recall  — 
Mr.  Mason:  Oh,  yes,  it  was  over  and  over. 
Hardy  said  that,  "I'm  appalled  at  your 
recommendation.".  .  .  . 
Question:  Well,  did  Mr.  Hardy's  "appall- 
ed" remark  and  Mr.  Mulloy's  "can't  launch, 
we   won't   be  able   to  launch   until   April" 
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remark,  how  did  that  affect  your  thinking 
and  affect  your  decision? 
Mr.  Mason:  My  personal  thinking,  I  just, 
you  know,   it  didn't  make  that  much  dif- 
ference.  .   .  . 

And  the  comments  that  they  made,  in  my 
view,  probably  had  got  more  reaction  from 
the  engineers]  at  the  lower  level  than  they 
would  from  the  manager[s],  because  we  deal 
with  people,  and  managers  all  the  time.  .  .  . 

Mr.  McDonald  indicated  that  during  the 
period  of  the  internal  Morton  Thiokol  caucus  he 
continued  to  argue  for  delay  with  Mulloy, 
challenging,  among  other  things,  the  rationale 
that  the  rocket  motor  was  qualified  down  to  40 
degrees  Farhenheit.  Present  were  Reinartz,  Jack 
Buchanan,  the  manager  of  Morton  Thiokol 
Launch  Support  Services  at  Kennedy,  and  Cecil 
Houston.  McDonald's  testimony  described  that 
conversation:17 

Mr.  McDonald:  .  .  .  while  they  were  off- 
line, reevaluating  or  reassessing  this  data 
...  I  got  into  a  dialogue  with  the  NASA 
people  about  such  things  as  qualification  and 
launch  commit  criteria. 

The  comment  I  made  was  it  is  my  under- 
standing that  the  motor  was  supposedly 
qualified  to  40  to  90  degrees. 

I've  only  been  on  the  program  less  than 
three  years,  but  I  don't  believe  it  was.  I  don't 
believe  that  all  of  those  systems,  elements, 
and  subsystems  were  qualified  to  that 
temperature. 

And  Mr.  Mulloy  said  well,  40  degrees  is 
propellant  mean  bulk  temperature,  and 
we're  well  within  that.  That  is  a  requirement. 
We're  at  55  degrees  for  that  — and  that  the 
other  elements  can  be  below  that  .  .  .  that, 
as  long  as  we  don't  fall  out  of  the  propellant 
mean  bulk  temperature.  I  told  him  I  thought 
that  was  asinine  because  you  could  expose 
that  large  Solid  Rocket  Motor  to  extremely 
low  temperatures  — I  don't  care  if  it's  100 
below  zero  for  several  hours  — with  that 
massive  amount  of  propellant,  which  is  a 
great  insulator,  and  not  change  that  pro- 
pellant mean  bulk  temperature  but  only  a 
few  degrees,  and  I  don't  think  the  spec  real- 
ly meant  that. 

But  that  was  my  interpretation  because  I 
had  been  working  quite  a  bit  on  the  filament 
wound  case  Solid  Rocket  Motor.  It  was  my 


impression  that  the  qualification 
temperature  was  40  to  90,  and  I  knew 
everything  wasn't  qualified  to  that 
temperature,  in  my  opinion.  But  we  were 
trying  to  qualify  that  case  itself  at  40  to  90 
degrees  for  the  filament  wound  case. 

I  then  said  I  may  be  naive  about  what 
generates  launch  commit  criteria,  but  it  was 
my  impression  that  launch  commit  criteria 
was  based  upon  whatever  the  lowest 
temperature,  or  whatever  loads,  or  whatever 
environment  was  imposed  on  any  element 
or  subsystem  of  the  Shuttle.  And  if  you  are 
operating  outside  of  those,  no  matter  which 
one  it  was,  then  you  had  violated  some 
launch  commit  criteria. 

That  was  my  impression  of  what  that  was. 
And  I  still  didn't  understand  how  NASA 
could  accept  a  recommendation  to  fly  below 
40  degrees.  I  could  see  why  they  took  issue 
with  the  53,  but  I  could  never  see  why  they 
would  ...  of  accept  a  recommendation 
below  40  degrees,  even  though  I  didn't  agree 
that  the  motor  was  fully  qualified  to  40.  I 
made  the  statement  that  if  we're  wrong  and 
something  goes  wrong  on  this  flight,  I 
wouldn't  want  to  have  to  be  the  person  to 
stand  up  in  front  of  board  of  inquiry  and  say 
that  I  went  ahead  and  told  them  to  go  ahead 
and  fly  this  thing  outside  what  the  motor  was 
qualified  to. 

I  made  that  very  statement. 

Mr.  Mulloy's  recollections  of  these  discussions 
are  as  follows:18 

Mr.  Mulloy:  Mr.  Kilminster  then  requested 
an  off-net  caucus.  It  has  been  suggested,  im- 
plied, or  stated  that  we  directed  Thiokol  to 
go  reconsider  these  data.  That  is  not  true. 
Thiokol  asked  for  a  caucus  so  that  they  could 
consider  the  discussions  that  had  ensued  and 
the  comments  that  Mr.  Hardy  and  I  and 
others  had  made. 

That  caucus,  as  has  been  stated,  was  go- 
ing to  start  at  that  point,  and  Mr.  McDonald 
interjected  into  the  teleconference.  At  that 
point,  he  made  the  first  comment  that  he  had 
made  during  this  entire  teleconference. 

Mr.  McDonald  testified  for  quite  a  while 
yesterday  about  his  thoughts  on  this,  but  he 
did  not  say  any  of  them  until  this  point.  At 
that  point,  he  stated  that  he  thought  what 
George  Hardy  said  was  a  very  important 
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consideration,  and  that  consideration  was. 
and  he  asked  Mr.  Kilminster  to  be  sure  and 
consider  the  comment  made  by  George  Har- 
dy during  the  course  of  the  discussions,  that 
the  concerns  expressed  were  for  primary  O- 
ring  blow-by  and  that  the  secondary  O-ring 
was  in  a  position  to  seal  during  the  time  of 
blow-by  and  would  do  so  before  significant 
joint  rotation  had  occurred. 

They  then  went  into  their  caucus,  having 
asked  for  five  minutes  — 
Mr.  Hotz:  ...  It  figures  quite  prominent- 
ly in  the  discussion  that  you  were  quoted  as 
saying,  do  you  expect  us  to  wait  till  April 
to  launch? 
Mr.  Mulloy:  Yes,  sir. 

Dr.  Walker:  Is  that  an  accurate  statement 
or  not0 

Mr.  Mulloy:  It  is  certainly  a  statement  that 
is  out  of  context,  and  the  way  I  read  the 
quote,  sir  — and  I  have  seen  it  many  times, 
too  many  times  — the  quote  I  read  was:  My 
God.  Thiokol.  when  do  you  want  me  to 
launch,  next  April? 

Mr.  McDonald  testified  to  another  quote 
that  says:  You  guys  are  generating  new 
Launch  Commit  Criteria. 

Now.  both  of  those  I  think  kind  of  go 
together,  and  that  is  what  I  was  saying.  I 
don't  know  whether  that  occurred  during  the 
caucus  or  subsequent  to.  I  just  simply  can't 
remember  that. 

Mr.  Hotz:  Well,  never  mind  the  timing. 

Mr.  Mulloy:  Well.  yes.  sir.  I'm  going  to 
answer  your  question  now.  I  think  those 
quotes  derive  from  a  single  thought  that  may 
have  been  expressed  by  me  using  some  of 
those  words. 

I  have  not  yet  encountered  anyone  other 
than  those  at  KSC  who  heard  those  words. 
so  I  don't  believe  they  were  transmitted  over 
tin-  net.  The  total  context  I  think  in  which 
those  words  may  have  been  used  is,  there 
are  currently  no  Launch  Commit  Criteria 
[LCC]  for  joint  temperature.  What  you  are 
proposing  to  do  is  to  generate  a  new  Launch 
Commit  Criteria  on  the  eve  of  launch,  after 
we  have  successfully  flown  with  the  existing 
Launch  Commit  Criteria  24  previous  times. 
With  this  LCC.  i.e.,  do  not  launch  with  a 
temperature  greater  [sic]  than  53  degrees, 
we  may  not  be  able  to  launch  until  next 


April.  We  need  to  consider  this  carefully 
before  we  jump  to  any  conclusions. 

It  is  all  in  the  context,  again,  with 
challenging  your  interpretation  of  the  data, 
what  does  it  mean  and  is  it  logical,  is  it  tru- 
ly logical  that  we  really  have  a  system  that 
has  to  be  53  degrees  to  fly0 

At  approximately  11  p.m.  Eastern  Standard 
Time,  the  Thiokol/NASA  teleconference  resum- 
ed, the  Thiokol  management  stating  that  they  had 
reassessed  the  problem,  that  the  temperature  ef- 
fects were  a  concern,  but  that  the  data  were  ad- 
mittedly inconclusive.  Kilminster  read  the  ra- 
tionale recommending  launch  and  stated  that  that 
was  Morton  Thiokol's  recommendation.  Hardy 
requested  that  it  be  sent  in  writing  by  telefax  both 
to  Kennedy  and  to  Marshall,  and  it  was.  The 
testimony  of  Mulloy  and  Hardy  regarding  the  re- 
mainder of  the  teleconference  and  their  rationale 
for  recommending  launch  follows:19 

Mr.  Mulloy:  Okay,  sir.  At  the  completion 
of  the  caucus,  of  course,  Mr.  Kilminster 
came  back  on  the  loop  and  stated  they  had 
assessed  all  the  data  and  considered  the 
discussions  that  had  ensued  for  the  past  cou- 
ple of  hours  and  the  discussions  that  oc- 
curred during  their  caucus. 
Chairman  Rogers:  Was  it  a  couple  of 
hours? 

Mr.  Mulloy:  Yes,  sir.  We  started  at  8:45 
and  I  believe  it  was  probably  1 1:00  o'clock 
before  he  came  back  on  the  loop.  It  was  a 
long  discussion.  And  I  must  emphasize  that 
I  had  no  knowledge  of  what  interchange  oc- 
curred during  the  caucus  at  Thiokol,  because 
all  sites  were  on  mute.  We  were  on  mute  at 
KSC.  No  communications  occurred  between 
myself  and  Mr.  Hardy  at  Huntsville.  nor  did 
any  communication  occur  between  KSC  and 
Thiokol  during  that  caucus. 

After  Mr.  Kilminster  made  that  recom- 
mendation, Mr.  Reinartz  then  asked  if  there 
were  any  further  comments,  and  to  my 
recollection  there  were  none.  There  were  no 
further  comments  made. 

I  then  asked  Mr.  Kilminster  to  send  me 
a  copy  of  his  flight  readiness  rationale  and 
recommendation.  The  conference  was  then 
terminated  at  approximately  11:15. 

I  have  no  knowledge  of,  as  has  been 
testified,  of  Mr.  McDonald  being  asked  to 
sign  that  documentation.  That  would  have 
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MTI  Assessment  of  Temperature  Concern  on  SRM-25  (51L)  launch 


Calculations  show  that  Srm-25  o-rings  will  be  20*  colder  than  SRM-15  o-rings 
Temperature  data  not  conclusive  on  predicting  primary  o-ring  blow-by 
Engineering  assessment  is  that: 

0  colder  o-rings  will  have  increased  effective  durometer  ("harder") 

0   'harder'  o-rings  will  take  longer  to  "seat" 

0  more  gas  may  pass  primary  o-ring  before  the  primary  seal  seats 

(RELATIVE  TO  SRM-15) 

0    DEMONSTRATED  SEALING  THRESHOLD  IS  3  TIMES  GREATER  THAN  0.038" 
EROSION  EXPERIENCED  ON  SRM-15 

0    IF  THE  PRIMARY  SEAL  DOES  NOT  SEAT/  THE  SECONDARY  SEAL  WILL  SEAT 

0   PRESSURE  WILL  GET  TO  SECONDARY  SEAL  BEFORE- THE  METAL  PARTS  ROTATE 

0   O-RING  PRESSURE  LEAK  CHECK  PLACES  SECONDARY  SEAL  IN  OUTBOARD 
POSITION  WHICH  MINIMIZES  SEALING  TIME 

MTI  RECOMMENDS  STS-51L  LAUNCH  PROCEED  ON  28  JANUARY  1988 
0   SRM-25  WILL  NOT  BE  SIGNIFICANTLY  DIFFERENT  FROM  SRM-15 


/{be  C.  Kilminster,  Vice  President 
-space  Booster  Programs 

Morton  Thiokol  Inc 

Wasatch  Division 


Copy  of  telefax  sent  Kennedy  and  Marshall  centers  by  Thiokol 
detailing  the  company's  final  position  on  the  January  28 
launch  of  mission  51 -L. 


been  unusual,  because  Mr.  Kilminster  signs 
all  flight  readiness  documentation. 

Now,  after  the  teleconference  was  com- 
plete, Mr.  McDonald  informed  Mr. 
Reinartz  and  me  that  if  the  Thiokol 
engineering  concern  for  the  effect  of  cold  was 
not  sufficient  cause  to  recommend  not 
launching,  there  were  two  other  considera- 
tions, launch  pad  ice  and  recovery  area 
weather. 

I  stated  that  launch  pad  ice  had  been  con- 
sidered by  the  Mission  Management 
Team  — 

Chairman  Rogers:  Excuse  me.  Could  you 
identify  that  discussion,  where  that  took 
place? 

Mr.  Mulloy:  That  was  after  the 
teleconference  was  completed,  after  Mr. 
Kilminster  made  his  recommendation,  after 
Mr.  Reinartz  asked  are  there  any  other  com- 
ments. There  were  no  other  comments  on 
the  telecon  from  anyone.  .  .  . 

I  stated  that  launch  pad  ice  had  been  con- 


sidered by  the  Mission  Management  Team 
before  deciding  to  proceed  and  that  a  fur- 
ther periodic  monitoring  of  that  condition 
was  planned.  I  further  stated  that  I  had  been 
made  aware  of  the  recovery  area  weather 
previously  and  planned  to  place  a  call  to  Mr. 
Aldrich  and  advise  him  that  the  weather  in 
the  recovery  area  exceeded  the  Launch 
Commit  Criteria. 

So  I  stated  earlier,  when  you  asked  what 
were  the  Launch  Commit  Criteria,  one  of 
them  was  that  the  recovery  area  weather  has 
limitations  on  it.  The  report  we  had,  that 
Mr.  McDonald  confirmed,  was  that  we  were 
outside  of  those  limits. 

Now,  I  must  point  out  that  that  is  not  a 
hard  Launch  Commit  Criteria.  That  is  an 
advisory  call,  and  the  LCC  so  states  that. 
It  does  require  that  we  discuss  the  condition. 

So  at  about  11:30  p.m.,  Mr.  Cecil 
Houston  established  a  teleconference  with 
Mr.  Aldrich  and  Mr.  Sestile  at  KSC.  I  in- 
formed Mr.  Aldrich  that  the  weather  in  the 
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recovery  area  could  preclude  immediate 
recovery  of  the  SRBs,  since  the  ships  were 
in  a  survival  mode  and  they  were  moving 
back  toward  Cape  Kennedy  at  about  three 
knots,  and  the  estimate  provided  to  us  by 
Mr.  Sestile  was  that  they  would  be  probably 
40  miles  from  the  SRB  impact  area  at  the 
time  of  launch,  at  9:38;  and  then,  continu- 
ing at  three  knots,  it  was  going  to  be  some 
period  of  time  before  they  could  get  back  and 
locate  the  boosters. 

The  concern  I  had  for  that  was  not  loss 
of  the  total  booster,  but  loss  of  the  main 
parachutes  for  the  booster,  which  are 
separated  at  water  impact,  and  loss  of  the 
frustum  of  the  boosters,  which  has  the 
drogue  parachute  on  it,  which  comes  down 
separately,  because  with  the  50  knot  winds 
we  had  out  there  and  with  the  kind  of  sea 
states  we  had,  by  the  time  the  recovery  ships 
got  back  out  there,  there  was  little  probabili- 
ty of  being  able  to  recover  those. 

I  informed  Mr.  Aldrich  of  that,  and  he 
decided  to  proceed  with  the  launch  after  that 
information.  I  did  not  discuss  with  Mr. 
Aldrich  the  conversations  that  we  had  just 
completed  with  Morton  Thiokol. 

Chairman  Rogers:  Could  you  explain  why? 

Mr.  Mulloy:  Yes,  sir.  At  that  time,  and  I 
still  consider  today,  that  was  a  Level  III 
issue,  Level  III  being  an  SRB  element  or  an 
external  tank  element  or  Space  Shuttle  main 
engine  element  or  an  Orbiter.  There  was  no 
violation  of  Launch  Commit  Criteria.  There 
was  no  waiver  required  in  my  judgment  at 
that  time  and  still  today. 

And  we  work  many  problems  at  the  Or- 
biter and  the  SRB  and  the  External  Tank 
level  that  never  get  communicated  to  Mr. 
Aldrich  or  Mr.  Moore.  It  was  clearly  a  Level 
III  issue  that  had  been  resolved. 

.  .  .  There  were  27  full-scale  seal  tests  with 
an  O-ring  groove  damage  tolerances, 
damage  in  the  grooves  and  damage  tolerance 
on  O-rings.  And  then  there  were  two  cold 
gas  tests. 

And  these  data  were  presented  on  the 
night  of  the  27th.  All  of  that  was  at  ambient 
temperature.  And  then  we  did  discuss  what 
is  a  development  qualification  motor  ex- 
perience range,  and  that  is  shown  on  the 


chart.  We  had  experience  everywhere  from 
40  to  85  degrees. 

There  then  were  data  presented  on  two 
cold  gas  tests  at  30  degrees,  where  the  O- 
ring  was  pressurized  at  the  motor  pressuriza- 
tion  rate  at  30  degrees,  which  would  indicate 
that  an  O-ring  would  operate  before  joint 
rotation  at  30  degrees. 
Dr.  Ride:  Was  that  actually  in  a  joint? 
Mr.  Mulloy:  No,  it  is  not.  It  is  a  full-scale 
O-ring,  full-scale  groove,  in  a  scaled  test 
device,  where  the  pressurize  rate  on  that  O- 
ring  is  zero  to  900  psi  [pounds  per  square 
inch]  in  600  milliseconds  at  a  temperature 
of  30  degrees. 

Dr.  Walker:  You  would  say,  then,  the  O- 
ring  was  qualified  to  a  temperature  of  30 
degrees?  WTould  that  be  an  accurate 
statement? 

Mr.  Mulloy:  The  day  that  we  were  look- 
ing at  it,  on  the  27th,  these  two  tests  that 
we  did  indicated  that  it  would  perform  at  30 
degrees  under  the  motor  pressurization  rate 
before  the  joint  rotated. 
Dr.  Walker:  What  about,  let's  consider  the 
putty  and  the  O-ring,  because  that  is  really 
the  system  that  responds  to  the  pressure 
surge.  What  temperature  was  the  putty/O- 
ring  system  qualified  to? 
Mr.  Mulloy:  The  lowest  that  I'm  aware 
of— and  we're  still  flushing  this  out,  because 
this  is  kind  of  what  we  talked  about  on  the 
27th,  but  the  lowest  that  I'm  aware  of  is  the 
40-degree  test  on  one  of  the  development 
motors. 

Dr.  Walker:  And,  of  course,  during  those 
tests  the  putty  was  modified  before  the  test. 
The  putty  was  not  just  laid  up  and  then  the 
seal  made.  The  putty  was  then  smoothed  out 
or  some  attempt  was  made  to  remove  the 
volcanoes,  I  think. 

Mr.  Mulloy:  Because  the  horizontal 
assembly  caused  that. 

Now,  there's  one  other  significant  point 
on  this  chart  that  we  did  discuss,  that  we 
didn't  have  the  quantities  on  on  the  27th, 
and  I  mentioned  this  earlier.  We  have  150 
case  segment  proof  tests,  with  a  large 
number  of  joints  with  a  simulation  of  a  cold 
O-ring.  That  is  the  90  durometer  with  a 
.275.  and  that  was  at  about  35  degrees. 
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So  those  are  the  certification  data  that  we 
kind  of  discussed,  all  of  which  we  didn't 
discuss.  The  two  cold  gas  tests  we  did,  the 
segment  proof  tests  we  did,  the  development 
and  qualification  motor  test  we  did,  as  a 
basis  for  understanding  what  we  could  ex- 
pect to  happen  at  colder  temperatures  on  the 
joints. 

Mr.  Hardy  testified  as  follows:20 

Mr.  Hardy:  At  the  teleconference  on  the 
evening  of  January  27,  1986,  Thiokol 
engineering  personnel  in  Utah  reviewed 
charts  that  had  been  datafaxed  to  Huntsville 
and  KSC  participants  just  prior  to  the  begin- 
ning of  the  conference.  Now,  I  am  not  go- 
ing to  repeat  a  lot  of  what  you  have  already 
heard,  but  I  will  give  you  some  of  my  views 
on  the  whole  matter. 

The  presentations  were  professional  in 
nature.  There  were  numerous  questions  and 
answers.  There  was  a  discussion  of  various 
data  and  points  raised  by  individuals  at 
Thiokol  or  at  Marshall  or  at  Kennedy.  I 
think  it  was  a  rather  full  discussion.  There 
were  some  14  charts  presented,  and  as  has 
been  mentioned  earlier,  we  spent  about  two, 
two  and  a  half  hours  reviewing  this.  To  my 
knowledge,  anyone  who  desired  to  make  a 
point,  ask  a  question  or  express  a  view  was 
in  no  way  restrained  from  doing  so. 

As  others  have  mentioned,  I  have  heard 
this  particular  teleconference  characterized 
as  a  heated  discussion.  I  acknowledge  that 
there  were  penetrating  questions  that  were 
asked,  I  think,  from  both,  from  all  people 
involved.  There  were  various  points  of  view 
and  an  interpretation  of  the  data  that  was 
exchanged.  The  discussion  was  not,  in  my 
view,  uncharacteristic  of  discussions  on 
many  flight  readiness  issues  on  many 
previous  occasions.  Thiokol  engineering 
concluded  their  presentation  with  recom- 
mendation that  the  launch  time  be  determin- 
ed consistent  with  flight  experience  to  date, 
and  that  is  the  launch  with  the  O-ring 
temperatures  at  or  greater  than  53  degrees 
Fahrenheit. 

Mr.  Kilminster  at  Thiokol  stated  ...  to 
the  best  of  my  recollection,  that  with  that 
engineering  assessment,  he  recommended 
we  not  launch  on  Tuesday  morning  as 
scheduled.  After  some  short  discussion,  Mr. 


Mulloy  at  KSC  summarized  his  assessment 
of  the  data  and  his  rationale  with  that  data, 
and  I  think  he  has  testified  to  that. 

Mr.  Reinartz,  who  was  at  KSC,  asked  me 
for  comment,  and  I  stated  I  was  somewhat 
appalled,  and  that  was  referring  specifically 
to  some  of  the  data  or  the  interpretation  of 
some  of  the  data  that  Thiokol  had  presented 
with  respect  to  its  influence  on  the  joint  seal 
performance  relative  to  the  issue  under 
discussion,  which  specifically  was  the 
possibility  that  the  primary  seal  may  take 
longer  to  actuate  and  therefore  to  blow  by 
the  primary  seal.  The  blow-by  of  the 
primary  seal  may  be  longer,  and  I  am  go- 
ing to  elaborate  on  that  a  little  further  in  this 
statement. 

Then  I  went  on  to  say  that  I  supported 
the  assessment  of  data  presented  essentially 
as  summarized  by  Mr.  Mulloy,  but  I  would 
not  recommend  launch  over  Thiokol's 
objections. 

Somewhere  about  this  time,  Mr. 
Kilminster  at  Utah  stated  that  he  wanted  to 
go  off  the  loop  to  caucus  for  about  five 
minutes.  I  believe  at  this  point  Mr. 
McDonald,  the  senior  Thiokol  represen- 
tative at  KSC  for  this  launch  suggested  to 
Mr.  Kilminster  that  he  consider  a  point  that 
I  think  I  had  made  earlier,  that  the  secon- 
dary O-ring  is  in  the  proper  position  to  seal 
if  blow-by  of  the  primary  O-ring  occurred. 

I  clearly  interpreted  this  as  a  somewhat 
positive  statement  of  supporting  rationale  for 
launch.  .  .  .  The  status  of  the  caucus  by 
Thiokol  lasted  some  30,  35  minutes.  At 
Huntsville  during  this  Thiokol  caucus,  we 
continued  to  discuss  the  data  presented.  We 
were  off  the  loop,  we  were  on  mute.  We  were 
around  a  table  in  small  groups.  It  was  not 
an  organized  type  discussion.  But  I  did  take 
that  opportunity  to  discuss  my  assessment 
and  understanding  of  the  data  with  several 
of  my  key  advisors,  and  none  of  us  had  any 
disagreement  or  differences  in  our  inter- 
pretation of  what  we  believed  the  data  was 
telling  us  with  regard  to  the  primary  issue 
at  hand. 

When  Thiokol  came  back  on  line,  Mr. 
Kilminster  reviewed  rationale  that  supported 
proceeding  with  the  launch  and  so 
recommended. 
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Mr.  Reinartz  asked  if  anyone  in  the  loop 
had  a  different  position  or  disagreed  or 
something  to  that  effect,  with  the  Thiokol 
recommendation  as  presented  by  Mr. 
Kilminster.  There  were  no  dissenting 
responses. 

The  telecon  was  terminated  shortly  after, 
and  I  have  no  knowledge  of  any  subsequent 
events  or  discussions  between  personnel  at 
KSC  or  at  Thiokol  on  this  matter. 

At  about  5:00  a.m.  on  January  28,  a  discus- 
sion took  place  among  Messrs.  Mulloy,  Lucas, 
and  Reinartz  in  which  Mulloy  reported  to  Lucas 
only  that  there  had  been  a  discussion  with  Thiokol 
over  their  concerns  about  temperature  effects  on 
the  O-rings,  and  that  it  had  been  resolved  in  favor 
of  launch.  The  following  testimony  of  Mr.  Mulloy 
and  Dr.  Lucas  recount  that  discussion:21 

General  Kutyna:  .  .  .  Larry,  let  me  follow 
through  on  that,  and  I  am  kind  of  aware  of 
the  launch  decision  process,  and  you  said 
you  made  the  decision  at  your  level  on  this 
thing. 

If  this  were  an  airplane,  an  airliner,  and 
I  just  had  a  two-hour  argument  with  Boe- 
ing on  whether  the  wing  was  going  to  fall 
off  or  not,  I  think  I  would  tell  the  pilot,  at 
least  mention  it. 

Why  didn't  we  escalate  a  decision  of  this 
importance? 
Mr.  Mulloy:  I  did,  sir. 
General  Kutyna:  You  did? 
Mr.  Mulloy:  Yes,  sir. 
General  Kutyna:  Tell  me  what  levels  above 
you. 

Mr.  Mulloy:  As  I  stated  earlier,  Mr. 
Reinartz,  who  is  my  manager,  was  at  the 
meeting,  and  on  the  morning,  about  5:00 
o'clock  in  the  operations  support  room  where 
we  all  were  I  informed  Dr.  Lucas  of  the  con- 
tenl  of  the  discussion. 

General   Kutyna:    But   this  is  not   in   the 
launch  decision  chain. 
Mr.  Mulloy:  No,  sir.  Mr.  Reinartz  is  in  the 
launch  decision  chain,  though. 
General  Kutyna:  And  is  he  the  highest  level 
in  that  chain? 

Mr.  Mulloy:  No.  Normally  it  would  go 
from  me  to  Mr.  Reinartz  to  Mr.  Aid  rich  to 
Mr.   Moore. 


Dr.  Lucas'  testimony  is  as  follows:22 

Chairman  Rogers:  Would  you  please  tell 
the  Commission  when  you  first  heard  about 
the  problem  of  the  O-rings  and  the  seals  in- 
sofar as  it  involves  launch  51-L?  And  I  don't 
want  you  to  go  way  back,  but  go  back  to 
when  you  first  heard.  I  guess  it  was  on 
January  27th,  was  it? 

Dr.  Lucas:  Yes,  sir.  It  was  on  the  early 
evening  of  the  27th,  I  think  about  7:00  p.m., 
when  I  was  in  my  motel  room  along  with 
Mr.  Kingsbury.  And  about  that  time,  Mr. 
Reinartz  and  Mr.  Mulloy  came  to  my  room 
and  told  me  that  they  had  heard  that  some 
members  of  Thiokol  had  raised  a  concern 
about  the  performance  of  the  Solid  Rocket 
Boosters  in  the  low  temperature  that  was  an- 
ticipated for  the  next  day,  specifically  on  the 
seals,  and  that  they  were  going  out  to  the 
Kennedy  Space  Center  to  engage  in  a 
telecon  with  the  appropriate  engineers  back 
at  Marshall  Space  Flight  Center  in  Hunts- 
ville  and  with  corresponding  people  back  at 
the  Wasatch  division  of  Thiokol  in  Utah. 
And  we  discussed  it  a  few  moments  and 
I  said,  fine,  keep  me  informed,  let  me  know 
what  happens. 

Chairman  Rogers:  And  when  was  the  next 
time  you  heard  something  about  that? 
Dr.  Lucas:  The  next  time  was  about  5:00 
a.m.  on  the  following  morning,  when  I  went 
to  the  Kennedy  Space  Center  and  went  to 
the  launch  control  center.  I  immediately  saw 
Mr.  Reinartz  and  Mr.  Mulloy  and  asked 
them  how  the  matter  of  the  previous  even- 
ing was  dispositioned. 

Chairman  Rogers:  You  had  heard  nothing 
at  all  in  between? 
Dr.  Lucas:  No,  sir. 

Chairman  Rogers:  So  from  8:00  o'clock  that 
evening  until  5:00  o'clock  in  the  morning, 
you  had  not  heard  a  thing? 
Dr.  Lucas:  It  was  about  7:00,  I  believe,  sir. 
But  for  that  period  of  time,  I  heard  nothing 
in  the  interim.  .  . 

Chairman  Rogers:  .  .  .  And  you  heard  Mr. 
Reinartz  say  he  didn't  think  he  had  to  notify 
you,  or  did  he  notify  you? 
Dr.  Lucas:  He  told  me,  as  I  testified,  when 
I  went  into  the  control  room,  that  an  issue 
had  been  resolved,  that  there  were  some  peo- 
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pie  at  Thiokol  who  had  a  concern  about  the 
weather,  that  that  had  been  discussed  very 
thoroughly  by  the  Thiokol  people  and  by  the 
Marshall  Space  Flight  Center  people,  and 
it  had  been  concluded  agreeably  that  there 
was  no  problem,  that  he  had  a  recommen- 
dation by  Thiokol  to  launch  and  our  most 
knowledgeable  people  and  engineering  talent 
agreed  with  that.  So  from  my  perspective. 
I  didn't  have  — I  didn't  see  that  as  an  issue. 
Chairman  Rogers:  And  if  you  had  known 
that  Thiokol  engineers  almost  to  a  man  op- 
posed the  flight,  would  that  have  changed 
your  view? 

Dr.  Lucas:  I'm  certain  that  it  would. 
Chairman  Rogers:  So  your  testimony  is  the 
same  as  Mr.  Hardy's.  Had  he  known,  he 
would  not  have  recommended  the  flight  be 
launched  on  that  day. 

Dr.  Lucas:  I  didn't  make  a  recommenda- 
tion one  way  or  the  other.  But  had  I  known 
that,  I  would  have  then  interposed  an  ob- 
jection, yes. 

Chairman  Rogers:  I  gather  you  didn't  tell 
Mr.  Aldrich  or  Mr.  Moore  what  Mr. 
Reinartz  had  told  you? 
Dr.  Lucas:  No,  sir.  That  is  not  the  report- 
ing channel.  Mr.  Reinartz  reports  directly 
to  Mr.  Aldrich.  In  a  sense,  Mr.  Reinartz  in- 
forms me  as  the  institutional  manager  of  the 
progress  that  he  is  making  in  implementing 
his  program,  but  that  I  have  never  on  any 
occasion  reported  to  Mr.  Aldrich. 
Chairman  Rogers:  And  you  had  subsequent 
conversations  with  Mr.  Moore  and  Mr. 
Aldrich  prior  to  the  flight  and  you  never 
mentioned  what  Mr.  Reinartz  had  told  you? 
Dr.  Lucas:  I  did  not  mention  what  Mr. 
Reinartz  told  me,  because  Mr.  Reinartz  had 
indicated  to  me  there  was  not  an  issue,  that 
we  had  a  unanimous  position  between 
Thiokol  and  the  Marshall  Space  Flight 
Center,  and  there  was  no  issue  in  his  judg- 
ment, nor  in  mine  as  he  explained  it  to  me. 
Chairman  Rogers:  But  had  you  known, 
your  attitude  would  have  been  totally 
different? 

Dr.  Lucas:  Had  I  had  the  advantage  at  that 
time  of  the  testimony  that  I  have  heard  here 
this  week.  I  would  have  had  a  different  at- 
titude, certainlv. 


Chairman  Rogers:  In  view  of  the  fact  that 
you  were  running  tests  to  improve  the  joint, 
didn't  the  fact  that  the  weather  was  so  bad 
and  Reinartz  had  told  you  about  the  ques- 
tions that  had  been  raised  by  Thiokol,  at 
least,  didn't  that  cause  you  serious  concern? 
Dr.  Lucas:  I  would  have  been  concerned  if 
Thiokol  had  come  in  and  said,  we  don't  think 
you  should  launch  because  we've  got  bad 
weather. 

Chairman  Rogers:  Well,  that's  what  they 
did.  of  course,  first.  That  is  exactly  what  they 
did.  You  didn't  know  that? 
Dr.  Lucas:  I  knew  only  that  Thiokol  had 
raised  a  concern. 

Chairman  Rogers:  Did  you  know  they  came 
and  recommended  against  the  launch,  is  the 
question? 

Dr.  Lucas:  I  knew  that  I  was  told  on  the 
morning  of  the  launch  that  the  initial  posi- 
tion of  some  members  of  Thiokol  — and  I 
don't  know  who  it  was  — had  recommended 
that  one  not  launch  with  the  temperature  less 
than  53  degrees  Fahrenheit. 
Chairman  Rogers:  And  that  didn't  cause 
you  enough  concern  so  you  passed  that  in- 
formation on  to  either  Mr.  Moore  or  Mr. 
Aldrich? 

Dr.  Lucas:  No,  sir,  because  I  was  shown  a 
document  signed  by  Mr.  Kilminster  that  in- 
dicated that  that  would  not  be  significant, 
that  the  temperature  would  not  be  — that  it 
would  be  that  much  lower,  as  I  recall  it. 

It  is  clear  that  crucial  information  about  the 
O-ring  damage  in  prior  flights  and  about  the 
Thiokol  engineers'  argument  with  the  NASA 
telecon  participants  never  reached  Jesse  Moore 
or  Arnold  Aldrich,  the  Levels  I  and  II  program 
officials,  or  J. A.  (Gene)  Thomas,  the  Launch 
Director  for  51-L.  The  testimony  of  Aldrich 
describes  this  failure  of  the  communication  system 
very  aptly:23 

Dr.  Feynman:  .  .  .  have  you  collected  your 
thoughts  yet  on  what  you  think  is  the 
cause  — I  wouldn't  call  it  of  the  accident  but 
the  lack  of  communication  which  we  have 
seen  and  which  everybody  is  worried  about 
from  one  level  to  another?  .  .  . 
Mr.  Aldrich:  Well,  there  were  two  specific 
breakdowns    at    least,    in    my    impression, 
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about  that  situation.  One  is  the  situation  that 
occurred  the  night  before  the  launch  and 
leading  up  to  the  launch  where  there  was  a 
significant  review  that  has  been  characteriz- 
ed in  a  number  of  ways  before  the  Commis- 
sion and  the  Commission's  Subpanels  and 
the  fact  that  that  was  not  passed  forward. 

And  I  can  only  conclude  what  has  been 
reported,  and  that  is  that  the  people  respon- 
sible for  that  work  in  the  Solid  Rocket 
Booster  project  at  Marshall  believed  that  the 
concern  was  not  of  a  significance  that  would 
be  required  to  be  brought  forward  because 
clearly  the  program  requirements  specify 
that  critical  problems  should  be  brought  for- 
ward to  Level  II  and  not  only  to  Level  II 
but  through  myself  to  Level  I. 

The  second  breakdown  in  communica- 
tions, however,  and  one  that  I  personally  am 
concerned  about  is  the  situation  of  the  varie- 
ty of  reviews  that  were  conducted  last  sum- 
mer between  the  NASA  Headquarters 
Organization  and  the  Marshall  Organiza- 
tion on  the  same  technical  area  and  the  fact 
that  that  was  not  brought  through  my  office 
in  either  direction  — that  is,  it  was  not 
worked  through  — by  the  NASA  Head- 
quarters Organization  nor  when  the  Mar- 
shall Organization  brought  these  concerns 
to  be  reported  were  we  involved. 

And  I  believe  that  is  a  critical  breakdown 
in  process  and  I  think  it  is  also  against  the 
documented  reporting  channels  that  the  pro- 
gram is  supposed  to  operate  to. 

Now,  it  in  fact  did  occur  in  that  matter. 
In  fact,  there  is  a  third  area  of  concern  to 
me  in  the  way  the  program  has  operated. 
There  is  yet  one  other  way  that  could  have 
come  to  me,  given  a  different  program  struc- 
ture. I'm  sure  you've  had  it  reported  to  you 
as  it  has  been  reported  to  me  that  in  August 
or  I  think  or  at  least  at  some  time  late  in  the 
summer  or  early  fall  the  Marshall  SRB  proj- 
ect went  forward  to  procure  some  additional 
Solid  Rocket  Motor  casings  to  be  machined 
and  new  configurations  for  testing  of  the 
joints. 

Now  it  turns  out  that  the  budget  for  that 
kind  of  work  does  not  come  through  my 
Le\el  II  office.  It  is  worked  directly  between 
the  Marshall  Center  in  NASA  Headquarters 
and  there  again  had  I  been  responsible  for 
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the  budget  for  that  sort  of  work,  it  would 
have  to  come  through  me,  and  it  would  have 
been  clear  that  something  was  going  on  here 
that  I  ought  to  know  about. 

And  so  there  are  three  areas  of 
breakdown,  and  I  haven't  exactly  answered 
your  question.  But  I  have  explained  it  in  the 
way  that  I  best  know  it  and  — well,  I  can  say 
a  fourth  thing. 

There  was  some  discussion  earlier  about 
the  amount  of  material  that  was  or  was  not 
reported  on  O-ring  erosion  in  the  FRRs 
[Flight  Readiness  Reviews]  and  I  researched 
the  FRR  back  reports  and  also  the  flight 
anomaly  reports  that  were  forwarded  to  my 
center  — to  my  office  — by  the  SRB  [Solid 
Rocket  Booster]  project  and  as  was  in- 
dicated, there  is  a  treatment  of  the  Solid 
Rocket  Motor  O-ring  erosion,  I  believe,  for 
the  STS  41 -C  FRR,  which  quantifies  it  and 
indicates  some  limited  amount  of  concern. 

The  next  time  that  is  mentioned,  I  believe 
it  is  the  STS  51-E,  FRR  in  January  1985 
or  early  in  February,  and  that  indicates, 
again,  a  reference  to  it  but  refers  back  to  the 
41 -C  as  the  only  technical  data. 

And  then  from  there  forward  the  com- 
ment on  O-ring  erosion  only  is  that  there  was 
another  instance  and  it  is  not  of  concern. 

Clearly  the  amount  of  reporting  in  the 
FRR  is  of  concern  to  me,  but  in  parallel  with 
that,  each  of  the  flight  anomalies  in  the  STS 
program  are  required  to  be  logged  and 
reviewed  by  each  of  the  projects  and  then 
submitted  through  the  Level  II  system  for 
formal  close-out. 

And  in  looking  back  and  reviewing  the 
anomaly  close-outs  that  were  submitted  to 
Level  II  from  the  SRB  project,  you  find  that 
O-ring  erosion  was  not  considered  to  be  an 
anomaly  and,  therefore,  it  was  not  logged 
and,  therefore,  there  are  not  anomaly  reports 
that  progress  from  one  flight  to  the  other. 

Yet,  that  is  another  way  that  that  infor- 
mation could  have  flagged  the  system,  and 
the  system  is  set  up  to  use  that  technique  for 
flagging. 


But  if  the  erosion  is  classified  as  not  an 
anomaly,  it  then  is  in  some  other  category 
and  the  system  did  not  force  it  in  that  direc- 
tion. None  of  those  are  very  focused 
answers,  but  they  were  all  factors. 

The  Commission  Chairman,  Mr.  Rogers, 
asked  four  key  officials  about  their  knowledge  of 
the  Thiokol  objections  to  launch:24 

Chairman  Rogers:  .  .  .  By  way  of  a  ques- 
tion, could  I  ask,  did  any  of  your  gentlemen 
prior  to  launch  know  about  the  objections 
of  Thiokol  to  the  launch? 
Mr.  Smith  [Kennedy  Space  Center  Direc- 
tor]: I  did  not. 

Mr.  Thomas  [Launch  Director]:  No,  sir. 
Mr.  Aldrich  [Shuttle  Program  Director]:  I 
did  not. 

Mr.  Moore  [Associate  Administrator  for 
Space  Flight]:  I  did  not. 

Additionally,  in  further  testimony  J.  A.  (Gene) 
Thomas  commented  on  the  launch.25 

Mr.  Hotz:  .  .  .  Mr.  Thomas,  you  are 
familiar  with  the  testimony  that  this  Com- 
mission has  taken  in  the  last  several  days  on 
the  relationship  of  temperature  to  the  seals 
in  the  Solid  Rocket  Booster? 
Mr.  Thomas:  Yes,  sir,  I  have  been  here  all 
week. 

Mr.  Hotz:  Is  this  the  type  of  information 
that  you  feel  that  you  should  have  as  Launch 
Director  to  make  a  launch  decision? 
Mr.  Thomas:  If  you  refer  to  the  fact  that 
the  temperature  according  to  the  Launch 
Commit  Criteria  should  have  been  53 
degrees,  as  has  been  testified,  rather  than  31 , 
yes,  I  expect  that  to  be  in  the  LCC.  That 
is  a  controlling  document  that  we  use  in  most 
cases  to  make  a  decision  for  launch. 
Mr.  Hotz:  But  you  are  not  really  very  hap- 
py about  not  having  had  this  information 
before  the  launch? 

Mr.  Thomas:  No,  sir.  I  can  assure  you  that 
if  we  had  had  that  information,  we  wouldn't 
have  launched  if  it  hadn't  been  53  degrees. 
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Findings 

1 .  The  Commission  concluded  that  there  was 
a  serious  flaw  in  the  decision  making  process 
leading  up  to  the  launch  of  flight  51-L.  A  well 
structured  and  managed  system  emphasizing 
safety  would  have  flagged  the  rising  doubts  about 
the  Solid  Rocket  Booster  joint  seal.  Had  these 
matters  been  clearly  stated  and  emphasized  in  the 
flight  readiness  process  in  terms  reflecting  the 
views  of  most  of  the  Thiokol  engineers  and  at  least 
some  of  the  Marshall  engineers,  it  seems  likely 
that  the  launch  of  51-L  might  not  have  occurred 
when  it  did. 

2.  The  waiving  of  launch  constraints  appears 
to  have  been  at  the  expense  of  flight  safety.  There 
was  no  system  which  made  it  imperative  that 
launch  constraints  and  waivers  of  launch  con- 
straints be  considered  by  all  levels  of 
management. 


3.  The  Commission  is  troubled  by  what  ap- 
pears to  be  a  propensity  of  management  at 
Marshall  to  contain  potentially  serious  problems 
and  to  attempt  to  resolve  them  internally  rather 
than  communicate  them  forward.  This  tendency 
is  altogether  at  odds  with  the  need  for  Marshall 
to  function  as  part  of  a  system  working  toward 
successful  flight  missions,  interfacing  and  com- 
municating with  the  other  parts  of  the  system  that 
work  to  the  same  end. 

4.  The  Commission  concluded  that  the 
Thiokol  Management  reversed  its  position  and 
recommended  the  launch  of  51-L,  at  the  urging 
of  Marshall  and  contrary  to  the  views  of  its 
engineers  in  order  to  accommodate  a  major 
customer.  ■ 


Chronology  of  Events  Related  to  Temperature  Concerns  Prior  to 
Launch  of  Challenger  (STS  51-L) 


Time 


Key  Participants 


Event 


12:36  PM  (EST) 
January  27,  1986 

Approximated 
1:00  PM  (EST) 


Approximately 

1:00  PM  (EST) 


NASA  Project  Managers  and  Contractor 
Support  Personnel  (including  Morton 
Thiokol). 

Same  as  above. 


Kennedy  Space  Center 

(1)  Boyd  C.  Brinton,  Manager, 
Space  Booster  Project,  MTI; 

(2)  Lawrence  O.  Wear,  Manager, 
SRM  Project  Office,  Marshall. 

Morion  Thiokol,    I  '/ah 

(1)  Arnold  R.  Thompson,  Super- 
visor. Rocket  Motor  Cases; 

(2)  Robert  Ebeling,  Manager,  Igni- 
tion System  and  Final  Assembly, 
SRM  Project. 


■  Launch  Scrub.  Decision  is  made  to 
scrub  due  to  high  crosswinds  at  launch 
site. 

■  Post-Scrub  Discussion.  All  appropriate 
personnel  are  polled  as  to  feasibility  to 
launch  again  with  24-hour  cycle  and  it 
results  in  no  SRB  constraints  for 
launch  at  9:38  AM,  28  January  1986. 

■  Request  is  made  for  all  participants 
to  report  any  constraints. 

■  Conversation.  Wear  asks  Brinton  if 
Thiokol  had  any  concerns  about 
predicted  low  temperatures  and  about 
what  Thiokol  had  said  about  cold 
temperature  effects  following  Januarv 
1985  flight  51-C. 

■  Brinton  telephones  Thompson  and 
other  MTI  personnel  to  ask  them  to 
determine  if  there  were  concerns  based 
on  predicted  weather  conditions.  Ebel- 
ing and  other  engineers  are  notified 
and  asked  for  evaluation. 
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Time 


Key  Participants 


Event 


Approximately 
2:00  PM  (EST) 


Approximately 
2:30  PM  (EST) 


NASA  Levels  I  and  II  Management  With 
Appropriate  Program  Managers  and  Con- 
tract Personnel 

(1)  Jesse  W.  Moore,  Associate  Ad- 
ministrator, Space  Flight,  NASA 
HQ,  and  Director,  JSC; 

(2)  Arnold  D.  Aldrich,  Manager, 
Space  Transportation  Systems  Pro- 
gram, JSC; 

(3)  Lawrence  B.  Mulloy,  Manager, 
SRB  Project,  Marshall  Space  Flight 
Center  (MSFC); 

(4)  Dr.  William  Lucas,  Director, 
MSFC. 

At  Thiokol,   Utah 

(1)  R.  Boisjoly,  Seal  Task  Force, 
Morton  Thiokol,  Utah; 

(2)  Robert  Ebeling,  Manager,  Igni- 
tion System  and  Final  Assembly, 
SRM  Project. 


■  Mission  Management  Team  Meeting. 
Discussion  is  centered  around  the 
temperature  at  the  launch  facility  and 
weather  conditions  predicted  for 
launch  at  9:38  AM  on  28  January 
1986. 


■   Boisjoly  learns  of  cold  temperatures 
at  Cape  at  meeting  convened  by 
Ebeling 


Approximately 
4:00  PM(EST) 


Approximately 
5:15  PM  (EST) 


At  Kennedy  Space  Center 

(1)  Allan  J.  McDonald,  Director, 
SRM  Project,  Morton  Thiokol; 

(2)  Carver  Kennedy,  Director  of 
Vehicle  Assembly  Building  Opera- 
tions, and  Vice  President  of  Space 
Operations  at  KSC,  for  Morton 
Thiokol. 

At  Thiokol,   Utah 
Robert  Ebeling,  Department 
Manager,  Ignition  System  and  Final 
Assembly,  SRM  Project. 


At  Kennedy  Space  Center 

(1)  Allan  J.  McDonald,  Director, 
SRM  Project,  Morton  Thiokol,  Inc. 

(2)  Cecil  Houston,  MSFC  Resident 
Manager,  at  KSC. 


■  Telephone  Conversation.   McDonald 
receives  call  at  Carver  Kennedy's 
residence  from  Ebeling  expressing  con- 
cern about  performance  of  SRB  field 
joints  at  low  temperatures. 

■  McDonald  indicates  he  will  call 
back  latest  temperature  predictions  up 
to  launch  time. 

■  Carver  Kennedy  calls  Launch 
Operations  Center  and  received  latest 
temperature  information. 

■  McDonald  transmits  data  to  Utah 
and  indicates  will  set  up  telecon  and 
asks  engineering  to  prepare. 

■  Telephone  Conversation.   McDonald 
calls  Cecil  Houston  informing  him  that 
Morton  Thiokol  engineering  had  con- 
cerns regarding  O-ring  temperatures. 

■  Cecil  Houston  indicates  he  will  set 
up  teleconference  with  Marshall  Space 
Flight  Center  and  Morton  Thiokol. 
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Time 


Key  Participants 


Event 


Approximately 
5:25  PM  (EST) 


Approximately 
5:30  PM  (EST) 


Approximately 
5:45  PM  (EST) 


At  Kennedy  Space  Center 

Cecil  Houston,  MSFC  Resident 

Manager,  at  KSC. 

At  Marshall  Space  Flight  Center 

Judson  A.  Lo\ingood,  Deputy 

Manager,  Shuttle  Projects  Office, 

MSFC. 


At  Kennedy  Space  Center 
Stanley  R.  Reinartz,  Manager,  Shut- 
tle Projects  Office,  MSFC 
At  Marshall  Space  Flight  Center 
Judson  A.  Loyingood,  Deputy 
Manager,  Shuttle  Projects  Office, 
MSFC. 

At  Kennedy  Space  Center 
Stanley  R.  Reinartz,  Manager,  Shut- 
tle Projects  Office  (MSFC). 
At  Marshall  Space  Flight  Center 
Judson  A.  Loyingood,  Deputy 
Manager,  Shuttle  Projects  Office, 
MSFC. 

Plus  other  personnel  at  Kennedy,  Marshall, 
and  Thiokol,   Utah. 


■  Telephone  Conversation.  Cecil  Houston 
calls  Loyingood,  informing  him  of  the 
concerns  of  temperature  on  the  O- 
rings  and  asks  him  to  establish  a 
telecon  with: 

(1)  Stanley  R.  Reinartz.  Manager. 
Shuttle  Projects  Office,  MSFC  (at 
Kennedy); 

(2)  Lawrence  B.  Mulloy,  Manager, 
SRB  Project,  MSFC  (at  Kennedy); 

(3)  George  Hardy,  Deputy  Director, 
Science  and  Engineering  (at  Marshall): 

(4)  Thiokol  Wasatch  Division 
personnel. 

■  Telephone  Conversation.   Lovingood 
calls  Reinartz  to  inform  him  of 
planned  5:45  PM  (EST) 
teleconference. 

■  Lovingood  proposes  that  Kingsbury 
(Director  of  Science  and  Engineering. 
MSFC),  participate  in  teleconference. 

■  First  Teleconference.  Concerns  regard- 
ing temperature  effects  on  the  O-rings 
are  discussed. 

■  MTI  is  of  the  opinion  launch 
should  be  delayed  until  Noon  or 
afternoon. 

■  It  is  decided  that  another  telecon  at 
8:15  PM  will  be  set  up  to  transmit  the 
data  to  all  of  the  parties  and  to  have 
more  personnel  involved. 

■  Lovingood  recommends  to  Reinartz 
to  include  Lucas,  Director,  MSFC  and 
Kingsbury  in  8:45  PM  conference  and 
to  plan  to  go  to  Level  II  if  MTI 
recommends  not  launching. 


Approximately  At  Marshall  Space  Flight  Center 

6:30  PM  (EST)  Judson  A.  Lovingood,  Deputy 

Manager,  Shuttle  Projects  Office, 
MSFC. 

At  Kennedy  Space  Center 
Stanley  R.  Reinartz,  Manager,  Shut- 
tle Projects  Office,  MSFC. 


■  Telephone  Conversation.   Lovingood 
calls  Reinartz  and  tells  him  that  if 
Thiokol  persists,  they  should  not 
launch. 

■  Lovingood  also  suggests  advising 
Aldrich,  Manager,  National  Transpor- 
tation System  (Level  II),  of  telecon- 
ference to  prepare  him  for  Level  I 
meeting  to  inform  of  possible  recom- 
mendation to  delav. 
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Time 


Key  Participants 


Event 


Approximately 
7:00  PM  (EST) 


At  Kennedy  Space  Center 

(1)  Lawrence  B.  Mulloy,  Manager, 
SRB  Project,  MSFC. 

(2)  Stanley  R.  Reinartz,  Manager, 
Shuttle  Projects  Office,  MSFC; 

(3)  Dr.  William  Lucas,  Director, 
MSFC; 

(4)  Jim  Kingsbury,  Director  of 
Science  and  Engineering,  MSFC. 


■   Conversation.  Reinartz  and  Mulloy 
visit  Lucas  and  Kingsbury  in  their 
motel  rooms  to  inform  them  of 
Thiokol  concern  and  planned 
teleconference. 


Approximately 
8:45  PM  (EST) 


At  Morton  Thiokol,   Utah 

(1)  Jerald  Mason,  Senior  Vice  Presi- 
dent, Wasatch  Operations; 

(2)  Calvin  Wiggins,  Vice  President 
and  General  Manager,  Space  Divi- 
sion, Wasatch; 

(3)  Joe  C.  Kilminster,  Vice  Presi- 
dent, Space  Booster  Programs, 
Wasatch; 

(4)  Robert  K.  Lund,  Vice  President, 
Engineering; 

(5)  Roger  Boisjoly,  Member  Seal 
Task  Force; 

(6)  Arnold  R.  Thompson,  Super- 
visor, Rocket  Motor  Cases. 

At  Kennedy  Space  Center 

(1)  Stanley  R.  Reinartz,  Manager, 
Shuttle  Projects  Office,  MSFC; 

(2)  Lawrence  B.  Mulloy,  Manager, 
SRB  Project,  MSFC; 

(3)  Allan  J.  McDonald,  Director, 
SRM  Project,  MTI. 

At  Marshall  Space  Flight  Center 

(1)  George  B.  Hardy,  Deputy  Direc- 
tor, Science  and  Engineering; 

(2)  Judson  A.  Lovingood,  Deputy 
Manager,  Shuttle  Project  Office; 

(3)  Ben  Powers,  Engineering  Struc- 
tures and  Propulsion. 

Plus  other  personnel  (see  table  page  111). 


■  Second  Teleconference.  Charts  present 
a  history  of  the  O-ring  erosion  and 
blow-by  for  the  primary  seal  in  the 
field  joints,  including  results  of 
subscale  tests,  previous  flights  and 
static  tests  of  Solid  Rocket  Motors. 

■  The  data  shows  that  the  timing 
function  of  the  O-rings  will  be  slower 
due  to  lower  temperatures  and  that  the 
worst  blow-by  occurred  on  SRM  15 
(STS  51-C)  in  January  1985  with  O- 
ring  temperatures  of  53  degrees 
Fahrenheit. 

■  Recommendation  by  Thiokol 
(Lund)  is  not  to  fly  STS  51-L 
(SRM-25)  until  the  temperature  of  the 
O-ring  reached  53  degrees  Fahrenheit, 
which  was  the  lowest  temperature  of 
any  previous  flight. 

■  Mulloy  asks  for  recommendation 
from  Kilminster. 

■  Kilminster  states  that  based  upon 
the  engineering  recommendation,  he 
can  not  recommend  launch. 

■  Hardy  is  reported  by  both 
McDonald  and  Boisjoly  to  have  said 
he  is  "appalled"  by  Thiokol's 
recommendation. 

■  Reinartz  comments  that  he  is  under 
the  impression  that  SRM  is  qualified 
from  40  degrees  Fahrenheit  to  90 
degrees  Fahrenheit. 

■  NASA  personnel  challenge  conclu- 
sions and  recommendations. 

■  Kilminster  asks  for  five  minutes  off- 
net  to  caucus. 
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Time 


Ki ;   Participants 


Event 


Approximately 

10:30  PM  (EST) 


Thiokol  Personnel 

(1)  Jerald  Mason,  Senior  Vice  Presi- 
dent. Wasatch  Operations; 

(2)  Joe  C.  Kilminster,  Vice  Presi- 
dent, Space  Booster  Program; 

(3)  Calvin  Wiggins,  Vice  President 
and  General  Manager,  Space 
Division: 

(4)  Robert  K.  Lund,  Vice  President, 
Engineering; 

(5)  Arnold  R.  Thompson,  Super- 
visor, Rocket  Motor  Cases; 

(6)  Roger  Boisjoly,  Member,  Seal 
Task  Force; 

(7)  Brian  Russell,  Special  Projects, 
SRM  Program  Office; 

(8)  Robert  Ebeling,  Manager,  Igni- 
tion System  and  Final  Assembly, 
SRM  Project. 

Plus  other  personnel 


■  Thiokol  Caucus.  Caucus  continues  for 
about  30  minutes  at  Thiokol, 
Wasatch,  Utah. 

■  Major  issues  are  (1)  temperature  ef- 
fects on  O-ring.  and  (2)  erosion  of  the 
O-ring. 

■  Thompson  and  Biosjoly  voice  objec- 
tions to  launch  and  indication  is  that 
Lund  also  is  reluctant  to  launch. 

■  A  final  management  review  is  con- 
ducted with  only  Mason,  Lund. 
Kilminster,  and  Wiggins. 

■  Lund  is  asked  to  put  on  manage- 
ment hat  by  Mason. 

■  Final  agreement  is:  (1)  there  is  a 
substantial  margin  to  erode  the 
primary  O-ring  by  a  factor  of  three 
times  the  previous  worst  case,  and  (2) 
even  if  the  primary  O-ring  does  not 
seal,  the  secondarv  is  in  position  and 
will. 


Approximately 
10:30  PM  to  ' 
11:00  PM  (EST) 


At  Kennedy  Space  Center 

(1)  Allan  J.  McDonald,  Manager, 
Space  Booster  Project,  Morton 
Thiokol,  Inc.  (MTI); 

(2)  Lawrence  B.  Mullov,  Manager, 
SRB  Projects,  MSFC;  ' 

(3)  Stanley  R.  Reinartz,  Manager, 
Shuttle  Projects,  MSFC; 

(4)  Jack  Buchanan,  Manager,  KSC 
Operations,  for  MTI; 

(5)  Cecil  Houston,  MSFC  Resident 
manager,  at  KSC. 


■  Conversation  at  Kennedy.  McDonald 
continues  to  argue  for  delay. 

■  McDonald  challenges  Reinartz's  ra- 
tionale that  SRM  is  qualified  at  40 
degrees  F.  to  90  degrees  F.,  and 
Mullov' s  explanation  that  Propellant 
Mean  Bulk  Temperatures  are  within 
specifications. 


Approximately 
11:00  PM  (EST) 


Same  participants  as  8:45  PM 
Teleconference. 


■  Second  Teleconference  (Cont'd).  Thiokol 
indicates  it  had  reassessed; 
temperature  effects  are  concern,  but 
data  is  inconclusive. 

■  Kilminster  reads  the  rationale  for 
recommending  launch. 

■  Thiokol  recommends  launch. 

■  Hardy  requests  that  Thiokol  put  in 
writing  their  recommendation  and 
send  it  by  fax  to  both  Kennedy  and 
Marshall. 
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Time 


Key  Participants 


Event 


Approximately 

11:15  to 

11:30  PM  (EST) 


Approximately 
11:45  PM  (EST) 


Approximately 
11:30  PM  to  ' 
12:00  AM  (EST) 


Approximately 
12:01  AM  (EST) 
January  28 

Approximately 

1:30  to 

3:00  AM  (EST) 


Approximately 
5:00  AM  (EST) 


At  Kennedy  Space  Center 

(1)  Allan  J.  McDonald,  Manager, 
Space  Booster  Project,  MTI; 

(2)  Lawrence  Mulloy,  Manager,  SRB 
Projects  Office,  MSFC; 

(3)  Stanley  R.  Reinartz,  Manager, 
Shuttle  Projects  Office,  MSFC; 

(4)  Jack  Buchanan,  Manager,  KSC 
Operations,  for  MTI; 

(5)  Cecil  Houston,  Manager,  MSFC 
Resident  Office  at  KSC. 


At  Kennedy  Space  Center 

(1)  Lawrence  B.  Mulloy,  Manager, 
SRB  Projects  Office,  MSFC; 

(2)  Stanley  R.  Reinartz,  Manager, 
Shuttle  Projects,  MSFC; 

(3)  Arnold  D.  Aldrich,  Manager,  Na- 
tional Space  Transportation  System 
Program  Office,  JSC. 


At  Kennedy  Space  Center 

(1)  Charles  Stevenson,  Supervisor  of 
Ice  Crew;  KSC 

(2)  B.K.  Davis,  Ice  Team  Member, 
MSFC 

At  Kennedy  Space  Center 

(1)  Lawrence  B.  Mullov,  Manager, 
SRB  Project,  MSFC; 

(2)  Dr.  William  Lucas,  Director, 
(MSFC); 

(3)  Jim  Kingsbury,  Director  of 
Science  and  Engineering,  MSFC. 


■  Conversation  at  Kennedy.  McDonald 
argues  again  for  delay  asking  how 
NASA  could  rationalize  launching 
below  qualification  temperature. 

■  McDonald  indicates  if  anything 
happened,  he  would  not  want  to  have 
to  explain  to  Board  of  Inquiry. 

■  McDonald  indicates  he  would 
cancel  launch  since  (1)  O-ring  problem 
at  low  temperatures;  (2)  booster 
recovery  ships  heading  into  wind 
toward  shore  due  to  high  seas,  and  (3) 
icing  conditions  on  launch  pad. 

■  McDonald  is  told  it  is  not  his  con- 
cern and  that  his  above  concerns  will 
be  passed  on  in  advisory  capacity. 

■  Telefax.  Kilminster  faxes  Thiokol's 
recommendation  to  launch  at  9:45 
MST,  27  Tanuary  1986  (11:45  EST). 

■  Fax  is  signed  by  Kilminster. 

■  McDonald  retrieves  fax  at  KSC. 

■  Teleconference.  Discussion  centers 
around  the  recovery  ships'  activities 
and  brief  discussion  of  the  ice  issue  on 
the  launch  complex  area. 

■  Reinartz  and  Mulloy  place  call  to 
Aldrich. 

■  McDonald  delivers  fax  to  Jack 
Buchanan's  office  at  Kennedy  Space 
Center  and  overhears  part  of 
conversation. 

■  Aldrich  is  apparently  not  informed 
of  the  O-ring  concerns. 

■  Kennedy  Space  Center  meeting 
breaks  up. 

■  Ice  Crew  Inspection  of  Launch  Pad  B. 
Ice  crew  finds  large  quantity  of  ice  on 
Fixed  Service  Structure,  mobile  launch 
platform,  and  pad  apron;  and  reports 
conditions. 

■  Conversation.  Mulloy  tells  Lucas  of 
Thiokol's  concerns  over  temperature 
effects  on  O-rings  and  final  resolution. 

■  Lucas  is  shown  copy  of  Thiokol 
telefax. 
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Time 


Key  Participants 


Event 


Approximately 
7:00-9:00  AM  (EST) 


Approximately 
8:00  AM  (EST) 


Approximately 
9:00  AM  (EST) 


Approximately 
10:30  AM  (EST) 


At  Kennedy  Space  Center 

(1)  Charles  Stevenson,  Supervisor  of 
Ice  Crew,  KSC; 

(2)  B.  K.  Davis,  Ice  Team  Member, 
MSFC. 


At  Marshall  Space  Flight  Center 

(1)  Judson  A.  Lovingood,  Deputy 
Manager,  Shuttle  Projects  Office, 
MSFC; 

(2)  Jack  Lee,  Deputy  Director, 
MSFC. 


NASA  Levels  I  and  Level  II  Management 
With  Appropriate  Project  Managers  and 
Contract  Personnel. 


At  Kennedy  Space  Center 

(1)  Charles  Stevenson,  Supervisor  of 
Ice  Crew; 

(2)  B.K.  Davis,  Ice  Team  Member 


11:38  AM  (EST) 


■  Ice  Crew  Inspection  of  Launch  Pad  B. 
Ice  crew  inspects  Launch  Pad  B  and 
Challenger  for  ice  formation. 

■  Davis  measures  temperatures  on 
SRBs,  External  Tank,  Orbiter,  and 
launch  pad  with  infrared  pyrometer. 

■  Left-hand  SRB  appears  to  be  about 
25  degrees  F.  and  right-hand  SRB  ap- 
pears to  be  about  8  degrees  F.  near 
the  aft  region. 

■  Ice  crew  is  not  concerned  since 
there  is  no  Launch  Commit  Criteria 
on  surface  temperatures  and  does  not 
report. 

■  Crew  reports  patches  of  sheet  ice  on 
lower  segment  and  skirt  of  left  Solid 
Rocket  Booster 

■  Conversation.  Lovingood  informs  Lee 
of  previous  night's  discussions. 

■  He  indicates  that  Thiokol  had  at 
first  recommended  not  launching,  and 
then  after  Wasatch  conference  recom- 
mended launching. 

■  He  also  informs  Lee  that  Thiokol  is 
providing  in  writing  their  recommen- 
dation for  launch. 

■  Mission  Management  Team  Meeting. 
Ice  conditions  at  launch  complex  are 
discussed.  There  is  no  apparent  discus- 
sion of  temperature  effects  on  O-ring 
seal. 

■  Ice  Crew  Inspection  of  Launch  Pad  B. 
Ice  crew  inspects  Launch  Pad  B  for 
third  time. 

■  Crew  removes  ice  from  water 
troughs,  returns  to  Launch  Control 
Center  at  T-20  minutes,  reports  condi- 
tions to  Mission  Management  Team, 
including  fact  that  ice  is  still  on  left 
Solid  Rocket  Booster. 

■  Launch.  Challenger  (STS  51-L)  is 
launched. 


110 


Final  Teleconference  Participants 


NASA  Marshall  Space  Flight  Center 


Morton  Thiokol  Wasatch  Division 


1.  George  B.  Hardy,  Deputy  Director,  Science 
and  Engineering,  MSFC 

2.  Judson  A.   Lovingood,   Deputy  Manager, 
Shuttle  Projects  Office,  MSFC 

3.  Leslie  F.  Adams,  Deputy  Manager,  SRB 
Project,  MSFC 

4.  Lawrence  O.  Wear,  Manager,  SRM  Proj- 
ect Office,  MSFC 

5.  John  Q.  Miller,  Technical  Assistant,  SRM 
Project,  MSFC 

6.  J.    Wayne   Littles,   Associate   Director  for 
Engineering,  MSFC 

7.  Robert  J.  Schwinghamer,  Director,  Material 
and  Processes  Laboratory,  MSFC 

8.  Wilbur    A.     Riehl,     Chief,     Nonmetallic 
Materials  Division,  MSFC 

9.  John  P.  McCarty,  Deputy  Director,  Struc- 
tures and  Propulsion  Laboratory,  MSFC 

10.  Ben   Powers,   Engineering  Structures  and 
Propulsion  Laboratory,  MSFC 

11.  James  Smith,  Chief  Engineer,   SRB  Pro- 
gram, MSFC 

12.  Keith  E.  Coates,  Chief  Engineer,  Special 
Projects  Office,  MSFC 

13.  John  Schell,   Retired  Engineer,   Materials 
Laboratory,  MSFC 

Present  at  KSC 

14.  Cecil  Houston,  MSFC  Resident  Manager, 
at  KSC 

15.  Stanley  R.  Reinartz,  Manager,  Shuttle  Proj- 
ects Office,  MSFC 

16.  Lawrence  B.  Mulloy,  Manager,  SRB  Proj- 
ect, MSFC 


1.  Jerald  Mason,  Senior  Vice  President, 
Wasatch  Operations,  MTI 

2.  Calvin  Wiggins,  Vice  President  and  General 
Manager,  Space  Division,  MTI 

3.  Joe  C.  Kilminster,  Vice  President,  Space 
Booster  Programs,  MTI 

4.  Robert  K.  Lund,  Vice  President,  Engineer- 
ing, MTI 

5.  Larry  H.  Sayer,  Director,  Engineering  and 
Design,  MTI 

6.  William  Macbeth,  Manager,  Case  Projects, 
Space  Booster  Project  Engineering,  Wasatch 
Division,  MTI 

7.  Donald  M.  Ketner,  Supervisor,  Gas 
Dynamics  Section  and  Head  Seal  Task 
Force,  MTI 

8.  Roger  Boisjoly,  Member,  Seal  Task  Force, 
MTI 

9.  Arnold  R.  Thompson,  Supervisor,  Rocket 
Motor  Cases,  MTI 

10.  Jack  R.  Kapp,  Manager,  Applied  Mechanics 
Department,  MTI 

11.  Jerry   Burn,   Associate   Engineer,   Applied 
Mechanics,  MTI 

12.  Joel  Maw,  Associate  Scientist,  Heat  Transfer 
Section,  MTI 

13.  Brian  Russell,  Manager,  Special  Projects, 
SRM  Project,  MTI 

14.  Robert  Ebeling,  Manager,  Ignition  System 
and  Final  Assembly,  SRB  Project.  MTI 

Present  at  MSFC 

15.  Boyd  C.  Brinton,  Manager,  Space  Booster 
Project,  MTI 

16.  Kyle  Speas,  Ballistics  Engineer,  MTI 


Present  at  KSC 

17.  Allan  J.  McDonald,  Director,  SRM  Project, 
MTI 

18.  Jack  Buchanan,  Manager,  KSC  Operations, 
MTI 
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Above,  Shuttle  51-L  on  Kennedy  Space  Center  Pad  39B  in 
the  early  morning  of  launch  day.  Temperatures  were  well 
below  freezing,  as  indicated  by  the  lower  left  photo,  which 
shows  thick  ice  in  a  water  trough  despite  use  of  an  anti- 
freeze solution. 


ff    ! 


Above,  foot  long  icicles  on  a  lower  level  of  the 
Fixed  Service  Structure  frame  the  attachment 
point  where  the  Orbiter  is  attached  to  the  exter- 
nal tank  (arrow).  Icing  was  even  more  extensive 
at  upper  levels  of  the  service  structure  (upper 
right  and  below).  At  right  below  is  a  ground  com 
munications  box  (not  used  during  launch)  ren- 
dered inoperable  by  heavy  ice. 


/ 
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Ambiguities  In 

The  Decision  Making  Process 


During  the  night  and  early  morning  of  January 
28,  another  problem  was  developing  due  to  the 
extreme  cold  weather,  predicted  to  be  in  the  low 
20s  for  approximately  11  hours.  Reaction  con- 
trol system  heaters  on  the  Orbiter  were  activated 
and  the  Solid  Rocket  Booster  recovery  batteries 
were  checked  and  found  to  be  functioning  within 
specifications.  There  were  no  serious  concerns 
regarding  the  External  Tank.  The  freeze  protec- 
tion plan  for  the  launch  pad  was  implemented, 
but  the  results  were  not  what  had  been  an- 
ticipated. The  freeze  protection  plan  usually  in- 
volves completely  draining  the  water  system. 
However,  this  was  not  possible  because  of  the  im- 
minent launch  of  51-L.  In  order  to  prevent  pipes 
from  freezing,  a  decision  was  made  to  allow  water 
to  run  slowly  from  the  system.  This  had  never 
been  done  before,  and  the  combination  of  freez- 
ing temperatures  and  stiff  winds  caused  large 
amounts  of  ice  to  form  below  the  240-foot  level 
of  the  fixed  service  structure  including  the  access 
to  the  crew  emergency  egress  slide  wire  baskets. 
Ice  also  was  forming  in  the  water  trays  beneath 
the  vehicle. 

These  conditions  were  first  identified  by  the  Ice 
Team  at  approximately  2:00  a.m.  on  January  28 
and  were  assessed  by  management  and  engineer- 
ing throughout  the  night,  culminating  with  a  Mis- 
sion Management  Team  meeting  at  9:00  a.m. 
At  this  meeting,  representatives  for  the  Orbiter 
prime  contractor,  Rockwell  International,  ex- 
pressed their  concern  about  what  effects  the  ice 
might  have  on  the  Orbiter  during  launch. 
Rockwell  had  been  alerted  about  the  icing  con- 
ditions during  the  early  morning  and  was  work- 
ing on  the  problem  at  its  Downey,  California, 
facility. 

During  Commission  hearings,  the  president  of 
Rockwell's  Space  Transportation  Systems  Divi- 
sion, Dr.  Rocco  Petrone,  and  two  of  his  vice 
presidents,  Robert  Glaysher  and  Martin  Ciof- 
foletti,  all  described  the  work  done  regarding  the 
ice  conditions  and  the  Rockwell  position  at  the 
9:00  a.m.  meeting  with  regard  to  launch.  Dr. 
Petrone  had  arrived  at  Kennedy  on  Friday, 
January  24.  On  Monday  the  27th  he  left  to  return 
to  Rockwell's  facility  in  California,  but  Glaysher 
and  Cioffoletti  remained  at  Kennedy.  Dr. 
Petrone  testified  that  he  first  heard  about  the  ice 


at  4:00  a.m.  Pacific  Standard  Time.  He  explained 
what  followed:26 

"I  had  gotten  up  and  went  to  the  support 
room  to  support  this  launch.  We  have  peo- 
ple monitoring  consoles,  and  I  checked  in, 
and  they  told  me  there  was  a  concern,  and 
when  I  arrived  at  about  4:30,  4:40  (PST), 
I  was  informed  we  were  working  the  prob- 
lem with  our  aerodynamicist  and  debris  peo- 
ple, but  very  importantly,  we  would  have 
to  make  an  input  to  Kennedy  for  a  meeting 
scheduled  at  6:00  o'clock  our  time  and  9:00 
o'clock  Florida  time. 

"We  had  approximately  an  hour  of  work 
to  bring  together.  The  work  had  been  under- 
way when  I  arrived  and  was  continuing. 

"At  that  time  I  got  on  the  phone  with  my 
Orbiter  program  managers  just  to  discuss 
background  of  where  we  were,  how  things 
stood,  and  what  their  concerns  were  local- 
ly. They  described  what  they  knew  in 
Florida,  and  we  also  in  Downey  did  televi- 
sion input,  and  we  could  see  some  of  the  ice 
scenes  that  were  shown  here  this  morning. 

"We  arrived  through  a  series  of  meetings 
to  a  top  level  discussion  at  approximately 
5:30  Pacific  Standard  Time,  from  which  we 
drew  the  following  conclusions:  Ice  on  the 
mobile  launcher  itself,  it  could  be  debris.  We 
were  very  concerned  with  debris  of  any  kind 
at  the  time  of  launch.  With  this  particular 
ice,  one,  could  it  hit  the  Orbiter?  There  was 
wind  blowing  from  the  west.  That  appeared 
not  to  be  so,  that  it  wouldn't  hit  the  Orbiter 
but  would  land  on  the  mobile  launcher.  The 
second  concern  was  what  happens  to  that  ice 
at  the  time  you  light  your  liquid  fuel  engines, 
the  SSMEs,  and  would  it  throw  it  around 
and  ricochet  and  potentially  hit  the  Orbiter. 

"The  third  aspect  is  the  one  that  has  been 
discussed  here  of  aspiration,  what  would 
happen  when  the  large  SRM  [Solid  Rocket 
Motors]  motors  ignite  and  in  effect  suck  in 
air,  referred  to  as  aspiration,  and  ice  addi- 
tionally would  come  down,  how  much 
unknown. 

"The  prime  thing  we  were  concerned 
about  was  the  unknown  base  line.  We  had 
not  launched  in  conditions  of  that  nature. 
and  we  just  felt  we  had  an  unknown. 

"I  then  called  my  program  managers  over 
in  Florida  at  5:45  (PST)  and  said  we  could 
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not  recommend  launching  from  here,  from 
what  we  see.  We  think  the  tiles  would  be  en- 
dangered, and  we  had  a  very  short  conver- 
sation. We  had  a  meeting  to  go  through,  and 
I  said  let's  make  sure  that  NASA  under- 
stands that  Rockwell  feels  it  is  not  safe 
to  launch,  and  that  was  the  end  of  my 
conversation." 

Mr.  Glaysher,  who  was  at  Kennedy,  came  to 
the  center  at  approximately  7:45  a.m.  EST.  He 
conferred  with  Rockwell's  Chief  Engineer  as  well 
as  the  Vice  President  of  Engineering,  Dr.  John 
Peller,  at  Rockwell's  Downey  plant.  At  9:00  a.m., 
after  the  ice  debris  team  had  reported  back  from 
the  pad  inspection,  Glaysher  was  asked  for 
Rockwell's  position  on  launch.  He  discussed 
aspiration  effects,  the  possible  ricochet  of  ice  from 
the  fixed  service  structure,  and  what  the  ice 
resting  on  the  mobile  launch  platform  would  do 
at  ignition.  Glaysher  said  he  told  the  Mission 
Management  Team  when  it  met  at  9:00  a.m.  that 
the  ice  was  an  unknown  condition,  and  Rockwell 
was  unable  to  predict  where  the  ice  would  go  or 
the  degree  of  potential  damage  to  the  Orbiter 
thermal  protection  system  if  it  were  struck  by  the 
ice.  He  testified  that  his  recommendation  to 
NASA  was:27 

"[M]y  exact  quote  — and  it  comes  in  two 
parts.  The  first  one  was,  Rockwell  could  not 
100  percent  assure  that  it  is  safe  to  fly  which 
I  quickly  changed  to  Rockwell  cannot  assure 
that  it  is  safe  to  fly  .  .  ." 

Rockwell's  other  vice  president  at  Kennedy, 
Martin  Cioffoletti,  described  the  concern  about 
ice  in  a  slightly  different  manner:28 

Mr.  Cioffoletti:  Similarly,  I  was  called  in 
and  told  about  the  problem  and  came  into 
the  6:00  o'clock  meeting  which  you  heard 
about  a  few  minutes  ago,  and  at  the  conclu- 
sion of  that  meeting  I  spoke  with  Mr.  Dick 
Kohrs,  the  deputy  program  manager  from 
Johnson  Space  Flight  Center,  and  he  asked 
if  we  could  get  the  Downey  folks  to  look  at 
the  falling  ice  and  how  it  might  reverse 
toward  the  vehicle,  and  also,  did  we  have 
any  information  on  aspiration  effects. 

So  I  did  call  back  to  Downey  and  got  the 
John  Peller  folks  working  on  that  problem, 
and  they  did,  as  you  saw  from  Charlie 
Stevenson's  sketches,  predict  that  the  ice 
would  travel  only  about  halfway  to  the  vehi- 


cle, freefalling  ice  carried  by  the  winds.  So 
we  felt  that  ice  was  not  a  problem.  However, 
it  would  land  on  the  mobile  launch  platform. 
That  we  considered  a  problem.  We  also  in- 
vestigated the  aspiration  data  base  we  had, 
and  we  had  seen  the  aspiration  effect  on 
previous  launches  where  things  were  pulled 
into  the  SRB  [Solid  Rocket  Booster]  hole 
after  ignition,  but  we  had  never  seen 
anything  out  as  far  as  the  fixed  surface 
tower.  So  we  felt  in  fact  it  was  an  unknown. 
We  did  not  have  the  data  base  to  operate 
from  an  aspiration  effect. 

At  the  9:00  o'clock  meeting,  I  was  asked 
by  Arnie  Aldrich,  the  program  manager,  to 
give  him  the  results  of  our  analysis,  and  I 
essentially  told  him  what  I  just  told  you  and 
felt  that  we  did  not  have  a  sufficient  data 
base  to  absolutely  assure  that  nothing  would 
strike  the  vehicle,  and  so  we  could  not  lend 
our  100  percent  credence,  if  you  will,  to  the 
fact  that  it  was  safe  to  fly  .  .  . 

I  said  I  could  not  predict  the  trajectory 
that  the  ice  on  the  mobile  launch  platform 
would  take  at  SRB  ignition. 

Chairman  Rogers:  But  I  think  NASA's 
position  probably  would  be  that  they  thought 
that  you  were  satisfied  with  the  launch.  Did 
you  convey  to  them  in  a  way  that  they  were 
able  to  understand  that  you  were  not  approv- 
ing the  launch  from  your  standpoint? 

Mr.  Cioffoletti:  I  felt  that  by  telling  them 
we  did  not  have  a  sufficient  data  base  and 
could  not  analyze  the  trajectory  of  the  ice, 
I  felt  he  understood  that  Rockwell  was  not 
giving  a  positive  indication  that  we  were  for 
the  launch. 

After  Cioffoletti's  testimony  at  the  Commission 
hearings,  Dr.  Petrone  was  pressed  for  a  more  de- 
tailed description  of  Rockwell's  launch  recom- 
mendation:29 

General  Kutyna:  Dr.  Petrone,  you've  got 
a  lot  more  experience  than  I  have  in  this 
business,  but  the  few  launch  conferences  that 
I  have  been  on  the  question  is  very  simple. 
Are  you  go  or  are  you  no-go  for  launch,  and 
"  maybe  "  isn't  an  answer.  I  hear  all  kinds 
of  qualifications  and  cautions  and  considera- 
tions here. 

Did  someone  ask  you  are  you  go  or  no- 
go?  Was  that  not  asked? 


115 


Dr.  Petrone:  At  this  particular  meeting,  as 
far  as  — and  I  was  not  in  Florida,  and  so  I 
cannot  answer  that.  It  had  been  done  at 
earlier  meetings.  This  was  a  technical 
evaluation  of  a  series  of  problems,  and  we 
talked  about  debris  hitting  the  TPS  [ther- 
mal protection  system]  and  the  tiles,  and  the 
long  series  of  reviews  that  we  had  done  that 
morning  and  all  led  us  to  a  conclusion  that 
they  were  not  safe  to  fly. 

And  we  transmitted  that  to  program 
managers  along  with  the  technical  evalua- 
tion quickly  of  why  we  had  arrived  at  that. 

So  much  of  it  is  how  the  question  gets  rais- 
ed because  earlier  we  had  aspiration  work, 
ricochet  work,  a  number  of  things  which  we 
did,  and  then  we  came  up  with  our 
recommendation. 

Chairman  Rogers:  And  your  recommenda- 
tion now  you  say  it  was,  it  was  unsafe  to  fly? 

Dr.  Petrone:  Correct,  sir. 

Two  things  are  apparent  from  the  Rockwell 
testimony.  First,  Rockwell  did  not  feel  it  had  suf- 
ficient time  to  research  and  resolve  the  ice  on  the 
pad  problem.  Second,  even  though  there  was  con- 
siderable discussion  about  ice,  Rockwell's  posi- 
tion on  launch  described  above  was  not  clearly 
communicated  to  NASA  officials  in  the  launch 
decision  chain  during  the  hours  preceding  51-L's 
launch. 

At  a  meeting  with  Commission  investigators 
on  March  4,  1986,  at  Kennedy,  Horace 
Lamberth,  NASA  director  of  Shuttle  Engineer- 
ing, said  he  did  not  interpet  Rockwell's  position 
at  the  9:00  a.m.  Mission  Management  Team 
meeting  on  January  28  as  being  "no-go." 
Lamberth  said  the  the  language  used  by  Rockwell 
was  "we  can't  give  you  100  percent  assurance"  but 
there  was  no  feeling  in  his  mind  that  Rockwell 
was  voicing  a  no-go  recommendation.  "It  just 
didn't  come  across  as  the  normal  Rockwell  no- 
go  safety  of  flight  issues  come  across."30  This  con- 
clusion is  confirmed  in  part  by  an  interview  of 
Dr.  John  Peller,  Rockwell's  Vice  President  of 
Engineering,  who  was  assigned  the  ice  problem 
early  Tuesday  morning.  Dr.  Peller,  in  describ- 
ing a  telephone  conversation  with  the  Johnson 
Director  of  Engineering.  Tom  Moser,  stated:31 

Dr.  Peller:  That  was  a  call  from  Tom  Moser 
to  me,  in  which  he  asked  again  to  under- 


stand my  concerns.  And  I  just  repeated  the 
same  concerns.  And  he  asked,  "Did  I  think 
that  it  was  likely  that  the  vehicle  would  take 
safety  critical  damage?" 

And  I  said,  "From  the  possibility  that  the 
vehicle  would  take  safety  critical  damage," 
I  said,  "there's  a  probability  in  a  sense  that 
it  was  probably  an  unlikely  event,  but  I 
could  not  prove  that  it  wouldn't  happen  .  .  ." 

...  I  never  used  the  words  "no-go"  for 
launch.  I  did  use  the  words  that  we  cannot 
prove  it  is  safe.  And  normally  that's  what  we 
were  asked  to  do.  We  were  unable  to  do  that 
in  this  particular  case,  although  it  was  a 
strange  case,  that  we  normally  don't  get  in- 
volved in. 

Arnold  Aldrich,  NASA  Mission  Management 
Team  Leader,  described  NASA's  view  of  the  ice 
situation  and  his  recollection  of  Rockwell's  posi- 
tion. He  said  that  on  Tuesday  morning  the  mis- 
sion management  team  did  a  detailed  analysis  of 
the  ice  on  the  fixed  service  structure.  Represent- 
atives from  the  ice  team,  Rockwell,  and  the  direc- 
tors of  Engineering  (Horace  Lamberth)  and  the 
Orbiter  project  (Richard  Colonna)  all  considered 
the  problem.  Aldrich  reported  this  discussion  as 
follows:32 

"Following  the  discussion  of  the  accept- 
ability of  the  ice  threat  to  the  Orbiter,  based 
upon  the  conditions  described  in  detail  of  the 
fixed  service  structure  — and  some  of  that 
you've  seen  here  portrayed  well  this  morn- 
ing—I asked  the  NASA  managers  involved 
for  their  position  on  what  they  felt  about  the 
threat  of  that  to  the  Orbiter. 

"Mr.  Lamberth  reported  that  KSC  [Ken- 
nedy Space  Center]  engineering  had 
calculated  the  trajectories,  as  you've  heard, 
of  the  falling  ice  from  the  fixed  service  struc- 
ture east  side,  with  current  10-knot  winds 
at  300  degrees,  and  predicted  that  none  of 
this  ice  would  contact  the  Orbiter  during  its 
ignition  or  launch  sequence;  and  that  their 
calculations  even  showed  that  if  the  winds 
would  increase  to  15  knots,  we  still  would 
not  have  contact  with  the  Orbiter. 

"Mr.  Colonna,  Orbiter  project  manager, 
reported  that  similar  calculations  had  been 
performed  in  Houston  by  the  mission 
evaluation  team  there.  They  concurred  in 
this  assessment.  And  further,  Mr.  Colonna 
stated  that,  even  if  these  calculations  were 
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significantly  in  error,  that  it  was  their  belief 
that  falling  ice  from  the  fixed  service  struc- 
ture, if  it  were  in  fact  to  make  its  way  to  the 
Orbiter,  it  would  only  be  the  most 
lightweight  ice  that  was  in  that  falling 
stream,  and  it  would  impact  the  Orbiter  at 
a  very  oblique  angle. 

"Impacts  of  this  type  would  have  very  low 
probability  of  causing  any  serious  damage 
to  the  Orbiter,  and  at  most  would  result  in 
post-flight  turnaround  repairs. 

"At  this  point  I  placed  a  phone  call  to  Mr. 
Moser  that  I  had  previously  mentioned, 
director  of  Engineering  at  the  Johnson  Space 
Center,  who  was  in  the  mission  evaluation 
room,  and  he  confirmed  the  detailed  agree- 
ment with  Mr.  Lamberth's  and  Mr.  Colon- 
na's  position.  .  .  . 

"And  both  Mr.  Lamberth  and  Mr. 
Colonna  reported  that  their  assessment  was 
that  the  time  it  took  for  the  ice  to  fall,  to  hit 
the  Orbiter  and  to  rebound,  and  the  loca- 
tion of  the  fixed  service  structure  on  the 
MLP  [mobile  launch  platform]  would  not 
cause  that  ice  in  their  view  to  be  a  concern 
to  rebound  and  come  up  and  impact  the  rear 
end  of  the  Orbiter. 

"Following  these  discussions,  I  asked  for 
a  position  regarding  proceeding  with  the 
launch.  Mr.  Colonna,  Mr.  Lamberth,  and 
Mr.  Moser  all  recommended  that  we 
proceed. 

"At  that  time,  I  also  polled  Mr.  Robert 
Glaysher,  the  vice  president,  Orbiter  proj- 
ect manager,  Rockwell  International  STS 
Division,  and  Mr.  Marty  Cioffoletti,  Shut- 
tle Integration  Project  Manager,  Rockwell 
International  STS  Division.  Mr.  Glaysher 
stated  —  and  he  had  been  listening  to  this  en- 
tire discussion  and  had  not  been  directly  in- 
volved with  it,  but  had  been  party  to  this  the 
whole  time. 

"His  statement  to  me  as  best  I  can 
reconstruct  it  to  report  to  you  at  this  time 
was  that,  while  he  did  not  disagree  with  the 
analysis  that  JSC  [Johnson  Space  Center] 
and  KSC  had  reported,  that  they  would  not 
give  an  unqualified  go  for  launch  as  ice  on 
the  launch  complex  was  a  condition  which 
had  not  previously  been  experienced,  and 
thus  this  posed  a  small  additional,  but  un- 


quantifiable,  risk.  Mr.  Glaysher  did  not  ask 
or  insist  that  we  not  launch,  however. 

"At  the  conclusion  of  the  above  review,  I 
felt  reasonably  confident  that  the  launch 
should  proceed." 

In  addition  to  Rockwell's  input,  Mr.  Aldrich 
also  had  reports  from  other  contractors  and  the 
ice,  frost  and  debris  team  at  the  9:00  session.  Ice 
on  the  vehicle  assembly  appeared  to  be  of  no  con- 
cern; sheet  ice  in  the  noise  suppression  trays  had 
been  broken  up  and  removed;  as  previously  noted 
the  ice  team  reported  that  there  was  ice  on  the 
fixed  service  structure  between  95  feet  above 
ground  and  215  feet;  no  ice  above  255  feet.  The 
north  and  west  sides  had  large  amounts  of  ice  and 
icicles.  The  final  assessment  was  made  that  the 
ice  on  the  fixed  service  structure  would  not  strike 
or  damage  the  Orbiter  tiles  or  the  vehicle 
assembly  during  ignition  or  ascent,  owing  to  the 
considerable  horizontal  distance  between  the  serv- 
ice structure  and  the  vehicle  assembly.  The  deci- 
sion was  made  to  launch  pending  a  final  ice  team 
review  of  the  launch  complex  in  order  to  assess 
any  changes  in  the  situation.  This  inspection  was 
completed  following  the  Mission  Management 
Team  meeting  and  the  ice  team  report  indicated 
no  significant  change. 

Findings 

The  Commission  is  concerned  about  three 
aspects  of  the  ice-on-the-pad  issue. 

1 .  An  analysis  of  all  of  the  testimony  and  in- 
terviews establishes  that  Rockwell's  recommen- 
dation on  launch  was  ambiguous.  The  Commis- 
sion finds  it  difficult,  as  did  Mr.  Aldrich,  to  con- 
clude that  there  was  a  no-launch  recommenda- 
tion. Moreover,  all  parties  were  asked  specifically 
to  contact  Aldrich  or  Moore  about  launch  objec- 
tions due  to  weather.  Rockwell  made  no  phone 
calls  or  further  objections  to  Aldrich  or  other 
NASA  officials  after  the  9:00  Mission  Manage- 
ment Team  meeting  and  subsequent  to  the 
resumption  of  the  countdown. 

2.  The  Commission  is  also  concerned  about 
the  NASA  response  to  the  Rockwell  position  at 
the  9:00  a.m.  meeting.  While  it  is  understood  that 
decisions  have  to  be  made  in  launching  a  Shut- 
tle, the  Commission  is  not  convinced  Levels  I  and 
II  appropriately  considered  Rockwell's  concern 
about  the  ice.  However  ambiguous  Rockwell's 
position  was,  it  is  clear  that  they  did  tell  NASA 
that  the  ice  was  an  unknown  condition.  Given 
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the  extent  of  the  ice  on  the  pad  (see  photos  pages 
112  and  113),  the  admitted  unknown  effect  of  the 
Solid  Rocket  Motor  and  Space  Shuttle  Main 
Engines  ignition  on  the  ice,  as  well  as  the  fact  that 
debris  striking  the  Orbiter  was  a  potential  flight 
safety  hazard,  the  Commission  finds  the  decision 
to  launch  questionable  under  those  circum- 
stances. In  this  situation,  NASA  appeared  to  be 
requiring  a  contractor  to  prove  that  it  was  not 
safe  to  launch,  rather  than  proving  it  was  safe. 
Nevertheless,  the  Commission  has  determined 
that  the  ice  was  not  a  cause  of  the  51-L  accident 
and  does  not  conclude  that  NASA's  decision  to 
launch  specifically  overrode  a  no-launch  recom- 
mendation by  an  element  contractor. 

3.  The  Commission  concluded  that  the  freeze 
protection  plan  for  launch  pad  39B  was  inade- 
quate. The  Commission  believes  that  the  severe 
cold  and  presence  of  so  much  ice  on  the  fixed  serv- 
ice structure  made  it  inadvisable  to  launch  on  the 
morning  of  January  28,  and  that  margins  of  safety 
were  whittled  down  too  far. 

Additionally,  access  to  the  crew  emergency 
slide  wire  baskets  was  hazardous  due  to  ice  con- 
ditions. Had  the  crew  been  required  to  evacuate 
the  Orbiter  on  the  launch  pad,  they  would  have 
been  running  on  an  icy  surface.  The  Commis- 
sion believes  the  crew  should  have  been  made 
aware  of  the  situation,  and  based  on  the 
seriousness  of  the  condition,  greater  considera- 
tion should  have  been  given  to  delaying  the 
launch.  ■ 
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Chaptei   VI 


An  Accident 
Rooted  in  History 


Early  Design 


The  Space  Shuttle's  Solid  Rocket 
Booster  problem  began  with  the 
faulty  design  of  its  joint  and  increased 
as  both  NASA  and  contractor  man- 
agement first  failed  to  recognize  it  as  a  problem, 
then  failed  to  fix  it  and  finally  treated  it  as  an 
acceptable  flight  risk. 

Morton  Thiokol.  Inc..  the  contractor,  did  not 
accept  the  implication  of  tests  early  in  the  pro- 
gram that  the  design  had  a  serious  and  unan- 
ticipated flaw.1  NASA  did  not  accept  the  judg- 
ment of  its  engineers  that  the  design  was  unac- 
ceptable, and  as  the  joint  problems  grew  in 
number  and  severity  NASA  minimized  them  in 
management  briefings  and  reports.2  Thiokol's 
stated  position  was  that  "the  condition  is  not 
desirable  but  is  acceptable ." 3 

Neither  Thiokol  nor  NASA  expected  the  rub- 
ber O-rings  sealing  the  joints  to  be  touched  by 
hot  gases  of  motor  ignition,  much  less  to  be  par- 
tially burned.  However,  as  tests  and  then  flights 
confirmed  damage  to  the  sealing  rings,  the  reac- 
tion by  both  NASA  and  Thiokol  was  to  increase 
the  amount  of  damage  considered  "acceptable." 
At  no  time  did  management  either  recommend 
a  redesign  of  the  joint  or  call  for  the  Shuttle's 
grounding  until  the  problem  was  solved. 

Thiokol  was  selected  to  receive  the  NASA  con- 
tract to  design  and  build  the  Solid  Rocket 
Boosters  on  November  20.  1973.4  The  booster 
was  the  largest  Solid  Rocket  Motor  ever  produced 
in  the  United  States;  it  was  also  the  first  solid 
motor  program  managed  by  NASA's  Marshall 
Space  Flight  ("enter  in  Huntsville,  Alabama. 

Costs  were  the  primary  concern  of  NASA's 
selection  board,  particularly  those  incurred  early 
in  the  program. 


Thiokol's  three  competitors  were  Aerojet  Solid 
Propulsion  Co.,  Lockheed  Propulsion  Co.  and 
United  Technologies.  The  Source  Evaluation 
Board  on  the  proposals  rated  Thiokol  fourth 
under  the  design,  development  and  verification 
factor,  second  under  the  manufacturing,  refur- 
bishment and  product  support  factor  and  first 
under  the  management  factor.5 

Thiokol  received  the  second  highest  overall 
Mission  Suitability  score,  tied  with  United 
Technologies.6 

In  a  December  12,  1973,  report.  NASA  selec- 
tion officials  said  Thiokol's  "cost  advantages  were 
substantial  and  consistent  throughout  all  areas 
evaluated."7  They  also  singled  out  Thiokol's  joint 
design  for  special  mention. 

"The  Thiokol  motor  case  joints  utilized  dual 
O-rings  and  test  ports  between  seals,  enabling  a 
simple  leak  check  without  pressurizing  the  entire 
motor,"  the  officials'  report  said.  "This  innovative 
design  feature  increased  reliability  and  decreas- 
ed operations  at  the  launch  site,  indicating  good 
attention  to  low  cost  (design,  development,  testing 
and  engineering)  and  production."8 

"We  noted  that  the  [NASA  Source  Selection] 
board's  analysis  of  cost  factors  indicated  that 
Thiokol  could  do  a  more  economical  job  than  any 
of  the  other  proposers  in  both  the  development 
and  the  production  phases  of  the  program;  and 
that,  accordingly,  the  cost  per  flight  to  be  ex- 
pected from  a  Thiokol-built  motor  would  be  the 
lowest."  the  officials  said.  "We.  therefore,  conclud- 
ed that  any  selection  other  than  Thiokol  would 
give  rise  to  an  additional  cost  of  appreciable 
size." 

The  Selection  officials  said  they  "found  no  other 
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factors  bearing  upon  the  selection  that  ranked  in 
weight  with  the  foregoing." 

Cost  consideration  overrode  any  other  objec- 
tions, they  decided.  "We  concluded  that  the  main 
criticisms  of  the  Thiokol  proposal  in  the  Mission 
Suitability  evaluation  were  technical  in  nature, 
were  readily  correctable,  and  the  costs  to  correct 
did  not  negate  the  sizable  Thiokol  cost  advan- 
tage," the  selection  officials  concluded. 

The  cost-plus-award-fee  contract,  estimated  to 
be  worth  $800  million,  was  awarded  to  Thiokol. 

The  design  of  the  Shuttle  Solid  Rocket  Booster 
was  primarily  based  on  the  Air  Force's  Titan  III 
solid  rocket,  one  of  the  most  reliable  ever  pro- 
duced. Thiokol  hoped  to  reduce  new  design  prob- 
lems, speed  up  the  development  program  and  cut 
costs  by  borrowing  from  the  Titan  design.  In 
Thiokol's  Solid  Rocket  Motor  proposal,  the  rocket 
fuel  is  contained  in  four  forged  steel  cases  which 
are  stacked  one  on  top  of  the  other.  The  casings 
were  connected  by  a  circumferential  tang  and 
clevis,  as  were  the  Titans.10 

Despite  their  many  similarities,  the  Thiokol 
Solid  Rocket  Booster  and  the  Titan  motors  had 
some  significant  design  differences.  For  example, 
the  joints  of  the  Titan  were  designed  so  that  the 
insulation  of  one  case  fits  tightly  against  the  in- 
sulation of  the  adjacent  case  to  form  a  more  gas- 
tight  fit  than  the  Thiokol  design.  One  O-ring  bore 
seal  was  used  in  each  Titan  joint  to  stop  any  hot 
gas  pressure  that  might  pass  by  the  insulation 
overlap,11  but  in  the  Titan  design  the  O-ring  was 
able  but  not  intended  to  take  the  brunt  of  the 
combustion  pressure.  In  contrast,  the  Thiokol  O- 
rings  were  designed  to  take  the  brunt  of  the  com- 
bustion pressure,  with  no  other  gas  barriers  pres- 
ent except  an  insulating  putty.  Also,  the  Solid 


Comparison  of  Original 
Design  to  Design  Used 


Original  design  with 
Face  Seal  and  Bore  Seal 
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Design  used  with 
Double  Bore  Seal 


Figure  1 


Rocket  Motor  joint  had  two  O-rings,  the  second 
to  provide  a  backup  in  case  the  primary  seal 
failed. 

Asbestos-filled  putty  was  used  in  the  Solid 
Rocket  Motor  to  pack  the  space  between  the  two 
case  segments  to  prevent  O-ring  damage  from  the 
heat  of  combustion  gases.12  Thiokol  believed  the 
putty  was  plastic,  so  when  acted  on  by  the  com- 
bustion pressure  at  the  motor's  ignition  the  put- 
ty flow  towards  the  O-ring  would  compress  the 
air  in  the  gap  between  the  putty  and  the  primary 
O-ring.13  The  compressed  air,  in  turn,  would 
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cause  the  primary  O-ring  to  extrude  into  the  gap 
between  the  clevis  and  the  tang,  behind  the 
primary  O-ring  groove,  thereby  sealing  the  open- 
ing. If  the  primary  O-ring  did  not  seal,  the  in- 
tent was  that  the  secondary  would  pressurize  and 
seal  the  joint  by  extruding  into  the  gap  behind 
its  groove.14 

Another  difference  in  the  Solid  Rocket  Motor 
and  the  Titan  was  that  the  tang  portion  of  the 
Thiokol  joint  was  longer  in  order  to  accommodate 
two  O-rings  instead  of  one.  It  was  more  suscep- 
tible to  bending  under  combustion  pressure  than 
the  Titan  joint,  as  post-design  tests  and  later  flight 
experience  demonstrated.15 

The  initial  Thiokol  design  proposal  was 
changed  before  the  production  motors  were 
manufactured.  Originally,  the  joint  seal  design 
incorporated  both  a  face  seal  and  a  bore  seal.16 
(Figure  1.)  However,  the  motor  that  was  even- 
tually used  had  double  bore  O-rings.  The  original 
bore  seal/face  seal  design  was  chosen  because  it 
was  anticipated  that  it  "provides  [better]  redun- 
dance over  a  double  bore  ring  seal  since  each  is 
controlled  by  different  manufacturing  tolerances, 
and  each  responds  differently  during  joint 
assembly."17  Because  the  early  design  incor- 
porated tolerances  similar  to  the  Titan  and  it  also 
incorporated  a  face  seal,  Thiokol  believed  it 
possessed  "complete,  redundant  seal  capability."  18 

Nevertheless,  as  the  Solid  Rocket  Motor  pro- 
gram progressed,  Thiokol  — with  NASA's 
concurrence  — dropped  the  face/bore  seal  design 
for  one  using  a  double  bore  seal  (Figure  1).  NASA 
engineers  at  Marshall  said  the  original  design 
would  have  required  tapered  pins  to  maintain 
necessary  tolerances  and  assure  enough  "squeeze" 
on  the  face-sealing  O-ring.19  However,  design 
analysis  determined  that  motor  ignition  would 
create  tension  loads  on  the  joint  sufficient  to  cause 
the  tapered  pins  to  pop  out.  Solving  that  would 
have  meant  designing  some  type  of  pin-retainers. 
Moreover,  the  rocket  assembly  was  much  easier 
with  the  dual  bore  seals.  Because  inspections  and 
tests  had  to  be  conducted  on  the  Solid  Rocket 
Motor  stack,  horizontal  assembly  was  required. 
Thiokol  engineer,  Howard  Mcintosh,  described 
this  in  a  Commission  interview  on  April  2,  1986: 

"We  were  concerned  very  much  about  the 
horizontal  assembly  that  we  had  to  do  to  do 
the  static  tests.  The  Titan  had  always  been 
assembled  vertically,  and  so  there  had  never 


been  a  larger  rocket  motor  to  our  knowledge 
that  was  assembled  (horizontally)".20 

Because  of  the  extremely  tight  tolerances  in  the 
joints  caused  by  horizontal  assembly,  Mcintosh 
noted,  "We  .  .  .  put  the  bore  seals  in  there,  and 
we  opened  the  tolerance  in  the  gaps  slightly  to 
accommodate  that."21  To  tighten  the  joint's  fit  and 
to  increase  the  squeeze  in  the  O-rings  to  compen- 
sate for  the  larger  tolerances,  Thiokol  subsequent- 
ly put  thin  metal  shims  between  the  outer  walls 
of  the  tang  and  clevis. 

Another  significant  feature  of  the  Thiokol 
design  was  a  vent,  or  port,  on  the  side  of  the 
motor  case  used  after  assembly  to  check  the  seal- 
ing of  the  O-rings.  As  will  be  noted  later,  this  leak 
check  eventually  became  a  significant  aspect  of 
the  O-ring  erosion  phenomenon.22 

The  manufacture  of  the  O-rings  themselves 
constituted  another  difference  between  the  Titan 
and  the  Thiokol  Solid  Rocket  Motor.  While  both 
O-rings  were  Viton  rubber,  the  Titan  O-rings 
were  molded  in  one  piece.  The  Solid  Rocket 
Motor  O-rings  were  made  from  sections  of  rub- 
ber O-xing  material  glued  together.  The  specifica- 
tions allowed  five  such  joints,  a  number  chosen 
arbitrarily,  and  the  vendor  routinely  made  repairs 
of  voids  and  inclusions  after  getting  the  material 
supplies.  Only  surface  inspections  were  per- 
formed by  Thiokol  and  by  the  manufacturer. 

Finally,  unlike  the  Titan,  the  Thiokol  Solid 
Rocket  Motor  was  designed  for  multiple  firings. 
To  reduce  program  costs,  each  Thiokol  motor 
case  for  the  Shuttle  was  to  be  recovered  after  flight 
and  reused  up  to  20  times.23 

Early  Tests 

Thiokol  began  testing  the  Solid  Rocket  Motor 
in  the  mid-1970's.  One  of  the  early  important  tests 
was  a  1977  "hydroburst  test."24 

Its  purpose  was  to  test  the  strength  of  the  steel 
cases  by  simulating  a  motor  firing.  The  case  was 
pressurized  with  water  to  about  one  and  one-half 
times  the  pressure  of  an  ignited  motor  (about 
1.500  pounds  per  square  inch)  to  make  certain 
the  case  had  adequate  structural  margin.25  Also, 
to  measure  the  pressure  between  the  O-rings, 
engineers  attached  instruments  to  the  leak  test 
port  at  a  segment  joint.  Although  the  test  was  suc- 
cessful in  that  it  demonstrated  the  case  met 
strength  requirements,  test  measurements  showed 
that,  contrary  to  design  expectations,  the  joint 
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tang  and  inside  clevis  bent  away  from  each  other 
instead  of  toward  each  other  and  by  doing  so 
reduced  — instead  of  increased  — pressure  on  the 
O-ring  in  the  milliseconds  after  ignition.26  This 
phenomenon  was  called  "joint  rotation."  Testi- 
fying before  the  Commission,  Arnold  Thompson, 
Thiokol's  supervisor  of  structures,  said, 

"We  discovered  that  the  joint  was  open- 
ing rather  than  closing  as  our  original 
analysis  had  indicated,  and  in  fact  it  was 
quite  a  bit.  I  think  it  was  up  to  52  one- 
thousandths  of  an  inch  at  that  time,  to  the 
primary  O-ring."27 

Thiokol  reported  these  initial  test  findings  to 
the  NASA  program  office  at  Marshall.  Thiokol 
engineers  did  not  believe  the  test  results  really 
proved  that  "joint  rotation"  would  cause  signifi- 
cant problems,28  and  scheduled  no  additional  tests 
for  the  specific  purpose  of  confirming  or  disprov- 
ing the  joint  gap  behavior. 

Design  Objections 

Reaction  from  Marshall  to  the  early  Solid 
Rocket  Motor  test  results  was  rapid  and  totally 
opposite  of  Thiokol's.  In  a  September  2,  1977 
memorandum,  Glenn  Eudy,  Marshall's  Chief 
Engineer  of  the  Solid  Rocket  Motor  Division,  in- 
formed Alex  McCool,  Director  of  the  Structures 
and  Propulsion  Laboratory,  that  the  assembly  of 
a  developmental  motor  provided  early  indications 
that  the  Thiokol  design: 

"Allowed  O-ring  clearance.  .  .  .  Some 
people  believe  this  design  deficiency  must  be 
corrected  by  some  method  such  as  shimming 
and  perhaps  design  modification  to  the  case 
joint  for  hardware  which  has  not  been  final 
machined.  ...  I  personally  believe  that  our 
first  choice  should  be  to  correct  the  design 
in  a  way  that  eliminates  the  possibility  of  O- 
ring  clearance.  .  .  .  Since  this  is  a  very 
critical  SRM  issue,  it  is  requested  that  the 
assignment  results  be  compiled  in  such  a 
manner  as  to  permit  review  at  the  S&E 
Director's  level  as  well  as  project  manager." 

After  seeing  the  data  from  the  September  1977 
hydroburst  test,  Marshall  engineer  Leon  Ray 
submitted  a  report  entitled  "Solid  Rocket  Motor 
Joint  Leakage  Study"  dated  October  21,  1977. 
It  characterizes  "no  change"  in  the  Thiokol  design 
as  "unacceptable"  — "tang  can  move  outboard  and 


cause  excessive  joint  clearance  resulting  in  seal 
leakage.  Eccentric  tang/clevis  interface  can  cause 
O-ring  extrusion  when  case  is  pressurized."  Ray 
recommended  a  "redesign  of  the  tang  and  reduce 
tolerance  on  the  clevis"  as  the  "best  option  for  a 
long-term  fix."29 

After  Ray's  1977  report,  John  Q.  Miller,  chief 
of  the  Solid  Rocket  Motor  branch  at  Marshall, 
signed  and  sent  a  memorandum  on  January  9, 
1978  to  his  superior,  Glenn  Eudy,  describing  the 
problems  evident  in  the  Solid  Rocket  Motor  joint 
seal.  "We  see  no  valid  reason  for  not  designing 
to  accepted  standards,"  the  memo  said,  and  it  em- 
phasized that  proper  sealing  of  the  joint  by  use 
of  shims  to  create  necessary  O-ring  pressure  was 
"mandatory  to  prevent  hot  gas  leaks  and  resulting 
catastrophic  failure."30 

One  year  later,  not  having  received  a  response 
to  his  1978  memo,  Miller  signed  and  forwarded 
a  second  memo  strenuously  objecting  to  Thiokol's 
Solid  Rocket  Motor  joint  seal  design.  This  memo, 
dated  January  19,  1979,  opened  with:  "We  find 
the  Thiokol  position  regarding  design  adequacy 
of  the  clevis  joint  to  be  completely  unaccept- 
able. .  .  ."31  The  memorandum  made  three  prin- 
cipal objections  to  Thiokol's  joint  design.  The  first 
was  the  "large  sealing  surface  gap  created  by  ex- 
tensive tang/clevis  relative  movement."  The 
memo  said  this  movement,  the  so-called  "joint 
rotation,"  caused  the  primary  O-ring  to  extrude 
into  the  gap,  "forcing  the  seal  to  function  in  a  way 
which  violates  industry  and  government  O-ring 
application  practices."32  Moreover,  joint  rotation 
allowed  the  secondary  O-ring  to  "become  com- 
pletely disengaged  from  its  sealing  surface  on  the 
tang."  Finally,  the  memorandum  noted  that 
although  Thiokol's  contract  required  all  high 
pressure  case  seals  to  be  verifiable,  "the  clevis  joint 
secondary  O-ring  seal  has  been  verified  by  tests 
to  be  unsatisfactory."33  A  copy  of  the  second 
memorandum  was  sent  to  George  Hardy,  then 
Solid  Rocket  Booster  project  manager  at  Mar- 
shall. Thiokol  apparently  did  not  receive  copies 
of  either  Miller  memorandum,  and  no  reply  from 
Eudy  to  Miller  has  been  found. 

The  Commission  has  learned  that  Leon  Ray 
actually  authored  the  Miller  memos  to  Eudy, 
although  Miller  signed  them  and  concurred  in  the 
objections  raised.34  During  February,  1979,  Ray 
also  reported  on  a  visit  he  made  to  two  O-ring 
manufacturers  — the  Preci  ion  Rubber  Products 
Corporation  at  Lebanoi  Tennessee,  and  the 
Parker  Seal  Co.  at  Lexington,  Kentucky35  Eudy 
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accompanied  Ray  on  the  Precision  visit.  The  pur- 
pose of  the  trips  was  to  give  the  manufacturers 
the  data  on  the  O-ring  experiences  at  Thiokol  and 
to  "seek  opinions  regarding  potential  risks  in- 
volved," Ray  wrote  in  a  February  9,  1979,  memo 
describing  the  visit.  Officials  at  Precision  did 
"voice  concern  for  the  design,  stating  that  the 
Solid  Rocket  Motor  O-ring  extrusion  gap  was 
larger  than  that  covered  by  their  experience, "  Ray 
reported.  "Their  first  thought  was  that  the  O-ring 
was  being  asked  to  perform  beyond  its  intended 
design  and  that  a  different  type  of  seal  should  be 
considered,"  Ray  added.36 

During  the  Commission  hearing  on  May  2, 
1986,  Ray  was  asked  why  the  1978  and  1979 
memoranda  were  written: 

Mr.  Ray:  The  reason  they  were  written  was 
as  a  result  of  test  data  that  we  had,  and  I 
have  to  go  back  to,  I  guess,  a  little  bit  fur- 
ther back  in  time  than  these  memos.  When 
the  joint  was  first  designed,  the  analysis  pro- 
duced by  Thiokol  says  the  joint  would  close, 
the  extrusion  gap  would  actually  close. 

We  had  quite  a  debate  about  that  until  we 
did  a  test  on  the  first  couple  of  segments  that 
we  received  from  the  manufacturer,  which 
in  fact  showed  that  the  joint  did  open.  Later 
on  we  did  some  tests  with  the  structural  test 
article,  and  this  is  mentioned  in  the  memo 
as  STA-1  [Structural  Test  Article]. 

At  that  time,  we  really  nailed  it  down.  We 
got  some  very  accurate  numbers  on  joint 
rotation,  and  we  know  for  a  fact  that  dur- 
ing these  tests  that,  just  what  the  memo  says, 
the  joint  rotated.  The  primary  O-ring  was 
extruded  up  into  the  joint.  The  secondary 
O-ring  did  in  fact  detach  from  the  seat.37 

No  records  show  Thiokol  was  informed  of  the 
visits,  and  the  O-ring  design  was  not  changed. 

Thiokol's  phase  1  certification  review  on  March 
23,  1979,  mentioned  leak  check  failures,  and 
forces  during  case  joint  assembly  that  resulted  in 
clevis  O-ring  grooves  not  conforming  with  tang 
sealing  surfaces.  However,  this  was  not  listed  as 
a  problem  or  a  failure.38 

Verification  and 
Certification  Committee 

While  Ray  was  warning  of  problems  with  joint 
rotation,  static  motor  tests  in  July  1978  and  April 
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1980  again  were  demonstrating  that  inner  tang/ 
clevis  relative  movement  was  greater  than  orig- 
inally predicted.39  Thiokol  continued  to  ques- 
tion the  validity  of  these  joint  rotation  measure- 
ments and  their  effect  on  the  availability  of  the 
secondary  O-ring. 

In  1980,  NASA  empanelled  a  Space  Shuttle 
Verification/Certification  Committee  to  study  the 
flight  worthiness  of  the  entire  Shuttle  system.  A 
subdivision  of  that  group,  the  Propulsion  Com- 
mittee, met  with  NASA  Solid  Rocket  Motor  pro- 
gram personnel  and  raised  several  concerns  about 
the  joint  design.40  The  Committee  pointed  out 
that  the  booster's  leak  test  pressurized  the  primary 
O-ring  in  the  wrong  direction  so  that  the  motor 
ignition  would  have  to  move  the  ring  across  its 
groove  before  it  sealed.  The  Committee  added 
that  the  effect  of  the  insulation  putty  was  not  cer- 
tain. Redundancy  of  the  O-rings  was  also  listed 
as  a  verification  concern.  The  same  report,  how- 
ever, said  "the  Committee  understands  from  a 
telecon  that  the  primary  purpose  of  the  second 
O-ring  is  to  test  the  primary  and  that  redundan- 
cy is  not  a  requirement."  George  Hardy  testified 
that  the  Committee's  statement  conflicted  with  his 
understanding: 

"The  discussion  there  or  the  reference 
there  to  a  telecon  — and  I  don't  know  who 
that  was  with  — that  implies  there  was  no  in- 
tent for  the  joint  to  be  redundant  is  totally 
foreign  to  me.  I  don't  know  where  they 
would  have  gotten  that  information  because 
that  was  the  design  requirement  for  the 
joint."41 

In  May  1980,  the  Verification/Certification 
Committee  recommended  that  NASA  conduct 
full-scale  tests  to  verify  the  field  joint  integrity, 
including  firing  motors  at  a  mean  bulk  propellant 
temperature  range  of  40-90  degrees  Fahrenheit. 
The  panel  also  asked  NASA  to: 

"Perform  case  burst  test  with  one  O-ring 
removed.  During  the  burst  test  for  final 
verification  of  the  motor  case  safety  factor, 
one  of  the  two  O-rings  failed  by  extrusion 
and  leaked.  The  analysis  used  for  additional 
verification  did  not  include  further  gap  open- 
ings caused  by  joint  deflection  at  pressuriza- 
tion  or  any  deflections  caused  by  bending 
loads.  The  panel  considers  the  above  to  be 
inadequate  to  provide  operational  program 
reliability,  and  marginal  to  provide  adequate 


safety  factor  confidence  on  [Shuttle  flight] 


one 


"42 


The  NASA  program  response  to  these  issues 
was  included  in  the  final  Committee  report  in 
September  1980.  It  said  that  the  original 
hydroburst  tests  and  the  lightweight  case  tests, 
being  conducted  at  the  time,  satisfied  the  intent 
of  the  Committee's  recommendations.  Moreover, 
the  response  stated:  "NASA  specialists  have 
reviewed  the  field  joint  design,  updated  with 
larger  O-rings  and  thicker  shims  and  found  the 
safety  factors  to  be  adequate  for  the  current 
design.  Re-analysis  of  the  joint  with  larger  Cu- 
rings and  thicker  shims  is  being  accomplished  as 
part  of  the  lightweight  case  program.  .  .  .  The 
joint  has  been  sufficiently  verified  with  the  testing 
accomplished  to  date  (joint  lab  tests,  structural 
test  article,  and  seven  static  firings  and  the  two 
case  configuration  burst  tests)  and  currently 
scheduled  for  lightweight  case  program."43 


Criticality  Classification 
and  Changes 

The  Solid  Rocket  Motor  certification  was 
deemed  satisfactory  by  the  Propulsion  Commit- 
tee of  the  Verification/Certification  Group  on 
September  15,  1980.  Shortly  thereafter,  on 
November  24,  1980,  the  Solid  Rocket  Booster 
joint  was  classified  on  the  Solid  Rocket  Booster 
Critical  Items  List  as  criticality  category  1R. 
NASA  defines  "Criticality  1R"  as  any  subsystem 
of  the  Shuttle  that  contains  "redundant  hardware, 
total  element  failure  of  which  could  cause  loss  of 
life  or  vehicle."44  The  use  of  "R",  representing 
redundancy,  meant  that  NASA  believed  the 
secondary  O-ring  would  pressurize  and  seal  if  the 
primary  O-ring  did  not.  Nonetheless,  the  1980 
Critical  Items  List  (CIL)  states: 

"Redundancy  of  the  secondary  field  joint 
seal  cannot  be  verified  after  motor  case 
pressure  reaches  approximately  40  percent 
of  maximum  expected  operating  pressure. 
It  is  known  that  joint  rotation  occurring  at 
this  pressure  level  with  a  resulting  enlarged 
extrusion  gap  causes  the  secondary  O-ring 
to  lose  compression  as  a  seal.  It  is  not  known 
if  the  secondary  O-ring  would  successfully 
reseal  if  the  primary  O-ring  should  fail  after 
motor  case  pressure  reaches  or  exceeds  40 


percent  of  maximum  expected  operating 
pressure." 

When  asked  about  the  text  of  the  1980 
Criticality  1R  classification,  Arnold  Aldrich, 
NASA  Manager  of  the  National  Space  Transpor- 
tation System,  said, 

"The  way  that  .   .   .  language  [reads],  I 
would  call  it  [criticality]  l."45 

Notwithstanding  this  apparent  contradiction  in 
the  classification  1R  and  the  questionable  status 
of  the  secondary  described  in  the  text  of  the  CIL, 
the  joint  carried  a  1R  classification  from 
November  1980  through  the  flight  of  STS-5 
(November  1982). 

The  Space  Shuttle  first  flew  on  April  12-14, 
1981 .  After  the  second  flight,  STS-2,  in  Novem- 
ber 1981,  inspection  revealed  the  first  in-flight 
erosion  of  the  primary  O-ring.46  It  occurred  in 
the  right  Solid  Rocket  Booster's  aft  field  joint  and 
was  caused  by  hot  motor  gases.47  The  damage 
to  the  ring  proved  to  be  the  worst  ever  found  on 
a  primary  O-ring  in  a  field  joint  on  any  recovered 
Solid  Rocket  Booster.48  Post-flight  examination 
found  an  erosion  depth  of  .053  inches  on  the 
primary  O-ring;  nonetheless,  the  anomaly  was 
not  reported  in  the  Level  I  Flight  Readiness 
Review  for  STS-3  held  on  March  9,  1982.  Fur- 
thermore, in  1982  the  STS-2  O-ring  erosion  was 
not  reported  on  the  Marshall  problem  assessment 
system  and  given  a  tracking  number  as  were  other 
flight  anomalies.49 

In  mid- 1982,  two  significant  developments 
took  place.  Because  Thiokol  believed  blow  holes 
in  the  insulating  putty  were  a  cause  of  the  ero- 
sion on  STS-2,50  they  began  tests  of  the  method 
of  putty  layup  and  the  effect  of  the  assembly  of 
the  rocket  stages  on  the  integrity  of  the  putty.  The 
manufacturer  of  the  original  putty,  Fuller- 
O'Brien,  discontinued  the  product  and  a  new  put- 
ty, from  the  Randolph  Products  Company,  was 
tested  and  selected  in  May  1982.51  The  new  Ran- 
dolph putty  was  eventually  substituted  for  the  old 
putty  in  the  summer  of  1983,  for  the  STS-8  Solid 
Rocket  Motor  flow.52 

A  second  major  event  regarding  the  joint  seal 
occurred  in  the  summer  of  1982.  As  noted  before, 
in  1977-78,  Leon  Ray  had  concluded  that  joint 
rotation  caused  the  loss  of  the  secondary  O-ring 
as  a  backup  seal.  Because  of  May  1982  high 
pressure  O-ring  tests  and  tests  of  the  new 
lightweight  motor  case,  Marshall  management 
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finally  accepted  the  conclusion  that  the  secondary 
O-ring  was  no  longer  functional  after  the  joints 
rotated  when  the  Solid  Rocket  Motor  reached  40 
percent  of  its  maximum  expected  operating 
pressure.  It  obviously  followed  that  the  dual  O- 
rings  were  not  a  completely  redundant  system, 
so  the  Criticality  1R  had  to  be  changed  to  Crit- 
icality  l.53  This  was  done  at  Marshall  on 
December  17,  1982.  The  revised  Critical  Items 
List  read  (See  pages  157  and  158): 

"Criticality  Category  1.  .  .  . 

"Failure  Mode  and  Causes:  Leakage  at  case 
assembly  joints  due  to  redundant  O-ring  seal 
failures  or  primary  seal  and  leak  check  port 
O-ring  failure. 

"Note:  Leakage  of  the  primary  O-ring  seal  is 
classified  as  a  single  failure  point  due  to  possibili- 
ty of  loss  of  sealing  at  the  secondary  O-ring  because 
of  joint  rotation  after  motor  pressurization. 

"Failure  Effect  Summary:  Actual  Loss  —  Loss 
of  mission,  vehicle  and  crew  due  to  metal  erosion, 
burn  through,  and  probable  case  burst  resulting  in 
fire  and  deflagration.  .  .  . 

"Rationale  for  Retention: 

"The  Solid  Rocket  Motor  case  joint  design 
is  common  in  the  lightweight  and  regular 
weight  cases  having  identical  dimensions. 
The  joint  concept  is  basically  the  same  as  the 
single  O-ring  joint  successfully  employed  on 
the  Titan  III  Solid  Rocket  Motor.  .  .  .  On  the 
Shuttle  Solid  Rocket  Motor,  the  secondary 
O-ring  was  designed  to  provide  redundancy 
and  to  permit  a  leak  check,  ensuring  proper 
installation  of  the  O-rings.  Full  redundancy 
exists  at  the  moment  of  initial  pressurization. 
However,  test  data  shows  that  a  phe- 
nomenon called  joint  rotation  occurs  as  the 
pressure  rises,  opening  up  the  O-ring  extru- 
sion gap  and  permitting  the  energized  ring 
to  protrude  into  the  gap.  This  condition  has 
been  shown  by  test  to  be  well  within  that  re- 
quired for  safe  primary  O-ring  sealing.  This 
gap  may,  however,  in  some  cases,  increase 
sufficiently  to  cause  the  unenergized  second- 
ary O-ring  to  lose  compression,  raising  ques- 
tion as  to  its  ability  to  energize  and  seal  if 
(ailed  upon  to  do  so  by  primary  seal  failure. 
Since,  under  this  latter  condition  only  the 
single  O-ring  is  sealing,  a  rationale  for  reten- 
tion is  provided  for  the  simplex  mode  where 


only  one  O-ring  is  acting"  [emphasis 
added].54 

The  retention  rationale  for  the  "simplex"  or 
single  O-ring  seal  was  written  on  December  1, 
1982.  by  Howard  Mcintosh,  a  Thiokol  engineer.55 
This  document  gave  the  justification  for  flight 
with  the  single  functional  O-ring.  It  reported  that 
tests  showed  the  Thiokol  design  should  be  re- 
tained, citing  the  Titan  history,  the  leak  and 
hydroburst  tests,  and  static  motor  firings  as 
justification.  However,  it  also  contained  the 
following  rationale  which  appeared  to  conflict 
with  the  Criticality  1  classification  that  the  sec- 
ondary O-ring  was  not  redundant: 

"Initial  information  generated  in  a  light- 
weight cylinder-to-cylinder  proof  test  shows 
a  total  movement  of  only  .030  inch  at  1,004 
pounds  per  square  inch,  gauge  pressure  in 
the  center  joint.  This  .  .  .  indicates  that  the 
tang-to-clevis  movement  will  not  unseat  the 
secondary  O-ring  at  operating  pressures." 56 

Testimony  in  hearings  and  statements  given 
in  Commission  interviews  support  the  view  that 
NASA  management  and  Thiokol  still  considered 
the  joint  to  be  a  redundant  seal  even  after  the 
change  from  Criticality  1R  to  1.  For  example, 
Mcintosh's  interview  states: 

Question:  [After  the  Criticality  I  classifica- 
tion], what  did  you  think  it  would  take  to 
make  [the  joint  seal]  1R? 

Mr.  Mcintosh:  I  thought  it  was  already 
1R.  I  thought  that  after  those  tests  that 
would  have  been  enough  to  do  it. 

Question:  Well,  you  knew  it  was  1  but  you 
were  hoping  for  1R? 

Mr  Mcintosh:  Yeah,  I  was  hoping  for  1R, 
and  I  thought  this  test  data  would  do  it,  but 
it  didn't.57 

At  the  time  (in  1982-83),  the  redundancy  of 
the  secondary  O-ring  was  analyzed  in  terms  of 
joint  or  hardware  geometry,  with  no  considera- 
tion being  given  to  the  resiliency  of  the  ring  as 
affected  by  temperatures.58  Moreover,  Marshall 
engineers  like  Ray  and  Miller  disagreed  with 
Thiokol's  calculations  on  the  measurement  of  joint 
opening.59  That  engineering  debate  eventually 
went  to  a  "referee"  for  testing  which  was  not  con- 
cluded until  after  the  51-L  accident. 
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Notwithstanding  the  view  of  some  of  Marshall 
engineers  that  the  secondary  ring  was  not  redun- 
dant, even  at  the  time  of  the  Criticality  revision, 
Marshall  Solid  Rocket  Motor  program  manage- 
ment appeared  to  believe  the  seal  was  redundant 
in  all  but  exceptional  cases.  Dr.  Judson  Lov- 
ingood  told  the  Commission: 

".  .  .  [T]here  are  two  conditions  you  have 
to  have  before  you  don't  have  redundancy. 
One  of  them  is  what  I  call  a  spatial  condi- 
tion which  says  that  the  dimensional  toler- 
ances have  to  be  such  that  you  get  a  bad 
stackup,  you  don't  have  proper  squeeze,  etc. 
on  the  O-ring  so  that  when  you  get  joint 
rotation,  you  will  lift  the  metal  surfaces  off 
the  O-ring.  All  right,  that's  the  one  condi- 
tion, and  that  is  a  worst  case  condition  in- 
volving dimensional  tolerances. 

"The  other  condition  is  a  temporal  con- 
dition which  says  that  you  have  to  be  past 
a  point  of  joint  rotation,  and  of  course,  that 
relates  back  to  what  I  just  said. 

"So  first  of  all,  if  you  don't  have  this  bad 
stackup,  then  you  have  full  redundancy. 
Now,  secondly,  if  you  do  have  the  bad 
stackup,  you  had  redundancy  during  the  ig- 
nition transient  up  to  the  170  millisecond 
point,  whatever  it  is,  but  that  is  the  way  I 
understand  the  [Critical  Items  List]."60 

George  Hardy  and  Lawrence  Mulloy  shared 
Lovingood's  view  that  the  secondary  seal  was 
redundant  in  all  but  situations  of  worst  case 
tolerances.61  However,  there  is  no  mention  of  this 
caveat  in  the  Critical  Items  List  itself,  nor  does 
it  appear  in  the  subsequent  "waiver"  of  the 
Criticality  1  status  granted  by  NASA  Levels  I  and 
II  in  March,  1983. 62  This  waiver  was  approved 
to  avoid  the  obligations  imposed  on  the  Shuttle 
Program  by  Paragraph  2.8  of  the  Space  Shuttle 
Program  Requirements  Document,  Level  I, 
dated  June  30,   1977.  That  paragraph  states: 

"The  redundancy  requirements  for  all 
flight  vehicle  subsystems  (except  primary 
structure,  thermal  protection  system,  and 
pressure  vessels)  shall  be  established  on  an 
individual  subsystems  basis,  but  shall  not  be 
less  than  fail-safe.  'Fail-safe'  is  defined  as  the 
ability  to  sustain  a  failure  and  retain  the 
capability  to  successfully  terminate  the  mis- 
sion. Redundant  systems  shall  be  designed 
so    that    their    operational    status    can    be 


verified  during  ground  turnaround  and  to 
the  maximum  extent  possible  while  in 
flight."63 

Glynn  Lunney,  the  former  manager  of  the  STS 
Program  (Level  II  at  JSC)  described  the  Criticali- 
ty 1  change  and  resulting  waiver  to  the  Commis- 
sion on  May  2: 

Mr.  Lunney:  Well,  the  approval  of  the 
waiver  in  March  of '83,  at  the  time  I  was 
involved  in  that.  I  was  operating  on  the 
assumption  that  there  really  would  be 
redundancy  most  of  the  time  except  when 
the  secondary  O-ring  had  a  set  of  dimen- 
sional tolerances  add  up,  and  in  that  ex- 
treme case  there  would  not  be  a  secondary 
seal. 

So  I  was  dealing  with  what  I  thought  was 
a  case  where  there  were  two  seals  unless  the 
dimensional  tolerances  were  such  that  there 
might  only  be  one  seal  in  certain  cases. 

Chairman  Rogers:  Now,  to  me,  if  you  will 
excuse  the  expression,  that  sounds  almost 
contradictory,  what  you  just  said.  What  you 
first  said  was  you  came  to  the  conclusion 
that  you  could  only  rely  on  the  primary  seal 
and  therefore  you  removed  the  R. 

Mr.  Lunney:  Yes,  sir. 

Chairman  Rogers:  And  now  you're  saying, 
if  I  understand  it,  that  experience  showed 
that  there  was  redundancy  after  all. 

Mr.  Lunney:  No,  I  don't  know  of  any  ex- 
perience showing  that.  What  I'm  saying  is 
that  the  removal  of  the  R  is  an  indicator  that 
under  all  circumstances  we  did  not  have 
redundancy.  There  were  a  certain  number 
of  cases  under  which  we  would  not  have 
redundancy  of  the  secondary  O-ring. 

Recognizing  that,  even  though  there  were 
a  lot  of  cases  where  we  expected  we  would 
have  redundancy  we  changed  the  criticali- 
ty designation. 

Chairman  Rogers:  It  was  saying  to 
everybody  else  you  can't  necessarily  rely  on 
the  primary  seal,  and  if  the  primary  seal 
fails,  as  you've  said  here,  there  may  be  loss 
of  vehicle,  mission  and  crew. 

Mr.  Lunney:  I  would  adjust  that  to  only 
say  you  cannot  rely  on  the  secondary  O-ring 


127 


but  we  would  expect  the  primary  O-ring  to 
always  be  there.64 

The  criticality  waiver  was  processed  outside  the 
formal  NASA  Program  Requirements  Control 
Board,  however,  representatives  of  that  group 
"signed  off  on  the  document.65  It  was  forward- 
ed to  Level  I  and  approved  by  Associate  Ad- 
ministrator for  Space  Flight  (Technical),  L. 
Michael  Weeks  on  March  28,  1983.  Weeks  told 
the  Commission  he  signed  the  waiver  because  of 
the  Certification/Verification  Review  of  the  Pro- 
pulsion Committee  in  1980.  Weeks  explained, 
"We  felt  at  the  time  — all  of  the  people  in  the  pro- 
gram I  think  felt  that  this  Solid  Rocket  Motor 
in  particular  or  the  Solid  Rocket  Booster  was 
probably  one  of  the  least  worrisome  things  we  had 
in  the  program."66  The  waiver  was  signed  less 
than  one  week  prior  to  the  launch  of  STS-6  on 
April  4.  According  to  interviews  of  Arnold 
Aldrich  and  of  Richard  Kohrs,  the  latter  having 
been  involved  with  the  waiver  review  at  Johnson 
Level  II,  the  waiver  was  approved  so  that  STS-6 
could  fly.67  However,  Weeks  denied  any  connec- 
tion between  the  Level  I  waiver  approval  and  the 
flight  of  STS-6.68 

Although  some  Thiokol  engineers  and  officials 
claimed  that  they  had  no  notice  of  the  Criticality 
change  and  waiver  in  December,  1982  and  in 
March,  1983,  from  the  approval  signatures  (in- 
cluding Thiokol's  Operations  Manager  at  Mar- 
shall, Maurice  Parker)  and  the  distribution  of  the 
Criticality  and  Waiver  documents,  apparently 
Thiokol  officials  were  sent  copies  and  were  in- 
volved in  the  criticality  reclassification.69 
Nonetheless,  the  Commission  has  also  deter- 
mined that  several  documents  tracking  the  O-ring 
erosion  at  Thiokol  and  Marshall  refer  to  the  Solid 
Rocket  Motor  field  joint  seal  as  Criticality  1-R, 
long  after  the  status  was  changed  to  Criticalitv 
l.70 


STS  41-B  O-Ring  Erosion 

As  Figure  2  shows,71  prior  to  STS  41-B,  the 
O-ring  erosion/blow-by  problem  was  infrequent, 
occurring  on  a  field  joint  of  STS-2  (November, 
1981),  nozzles  of  STS-6  (April,  1983)  and  a  noz- 
zle of  QM-4  (March,  1983),  a  qualification  test 
motor  fired  by  Thiokol.72  However,  when  STS 
41-B  flew  on  February  3,  1984,  the  left  Solid 
Rocket  Booster  forward  field  joint  and  the  right 


nozzle  joint  primary  O-rings  both  suffered  ero- 
sion damage.  Thiokol  engineers  reacted  to  this 
discovery  by  filing  a  problem  report  on  the  O- 
ring  erosion  found  on  STS  41-B.  Thiokol 
presented  a  series  of  charts  to  the  Marshall  Solid 
Rocket  Booster  Engineering  Office  about  the 
41-B  O-ring  erosion.  Thiokol  told  Marshall  that 
recent  joint  rotation  measurements  in  tests  in- 
dicated the  secondary'  O-ring  will  not  unseat,  pro- 
viding confidence  that  the  secondary  was  an  ade- 
quate backup.  Keith  Coates  described  his  view 
about  Thiokol's  data  in  a  February  29,  1984 
memorandum  to  George  Hardy: 

"We  have  two  problems  with  their  ra- 
tionale. The  effect  of  0.065  inch  erosion  on 
O-ring  sealing  capability  is  not  addressed. 
We  have  asked  Thiokol  to  provide  their  data 
to  justify  their  confidence  in  the  degraded 
O-ring.  The  second  concern  is  the  amount 
of  joint  rotation.  L.  Ray  does  not  agree  with 
Thiokol  numbers,  and  he  has  action  to 
discuss  his  concern  with  R.  Boisjoly 
(Thiokol)  and  reach  agreement. 

"Thiokol  definition  of  their  plans  on 
resolution  of  the  problem  is  very  weak." 

The  erosion  problem  was  identified  and 
tracked  by  the  Marshall  Problem  Assessment 
System  as  Marshall  Record  A07934  and  by 
Thiokol  as  Thiokol  Contractor  Record 
DR4-5/30,  "Slight  char  condition  on  primary  O- 
ring  seal  in  forward  field  joint  on  SRM  A57  of 
STS-11  flight,  Mission  41B."73  The  Marshall 
Problem  Assessment  System  Report  states: 

"Remedial  action  — none  required;  prob- 
lem occurred  during  flight.  The  primary  O- 
ring  seal  in  the  forward  field  joint  exhibited 
a  charred  area  approximately  1  inch  long 
.03-. 050  inches  deep  and  .100  inches  wide. 
This  was  discovered  during  post-flight  seg- 
ment disassembly  at  KSC." 

A  March  8,  1984  entry  on  the  same  report 
continues: 

"Possibility  exists  for  some  O-ring  erosion 
on  future  flights.  Analysis  indicates  max. 
erosion  possible  is  .090  inches  according  to 
Flight  Readiness  Review  findings  for 
STS-13.  Laboratory  test  shows  sealing  in- 
tegrity at  3,000  psi  using  an  O-ring  with  a 
simulated  erosion  depth  of  .095  inches. 
Therefore,  this  is  not  a  constraint  to  future 
launches."74 
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Figure  2 


O-Ring  Anomalies  Compared  with  Joint  Temperature  and  Leak  Check  Pressure 


Flight 

or 

Motor 

Date 

(Solid 
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Booster) 
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NA 

NA 

— 

— 

61 
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— 

— 

NA 

NA 

— 

— 

40 
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— 

— 

NA 

NA 

— 

— 

83 
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— 

— 

NA 

NA 

— 

— 

67 
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02/13/80 

— 

— 

NA 

NA 

— 

— 

45 
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04/12/81 

— 

— 

50 

50 

— 

— 

66 
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(Right) 
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50 

50 

X 

70 
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03/22/82 

— 

— 

50 

50 

— 

— 

69 

STS-4 

06/27/82 
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50 

50 

NA 

NA 

80 

DM-5 

10/21/82 

— 

— 

NA 

XA 

— 

— 

58 
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50 

50 

— 

— 
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QM-4 
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— 
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NA 

NA 

X 
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50 

50 
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(Left) 
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— 
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50 

— 
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70 

STS  41-B 
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57 
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04/06/84 

(Right) 
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200 

100 
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63 

Dash  (  — )  denotes  no  anomaly. 
NA  denotes  not  applicable. 

NOTE:  A  list  of  the  sequence  of  launches  (1-25),  identified  by  STS  mission  designation,  is  pro- 
yided  on  pages  4  thru  6. 


1  On  STS-6,  both  nozzles  had  a  hot  gas  path  detected  in  the  putty  with  an  indication  of  heat  on 
the  primary  O-ring. 

2  On  STS-9,  one  of  the  right  Solid  Rocket  Booster  Field  joints  was  pressurized  at  200  psi  after 
a  destack. 
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Flight 

or 

Mi  it  i  n 
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NA 
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63 


63 
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70 
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NA 

NA 

X 
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— 

— 
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— 
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- 
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NA 

NA 

X 

X 
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— 

— 
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(Right) 

Center  Field/ 
Secondary 

200 
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53 

(Right) 

Nozzle/ 
Primary 

200 

100 

X 
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53 

53 
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NA 
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STS  51-B    04/29/85       (Right)         Nozzle/ 
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(Left) 
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00 


X 


X 


/D 


/D 


Dash  (  — )  denotes  no  anomaly. 
NA  denotes  not  applicable. 

NOTE:  A  list  of  the  sequence  of  launches  (1-25),  identified  by  STS  mission  designation,  is  pro- 
vided on  pages  4  thru  6. 

3  On  STS  41-C,  left  aft  field  had  a  hot  gas  path  detected  in  the  putty  with  an  indication  of  heat 
on  the  primary  O-ring. 

4  On  a  center  field  joint  of  STS  51-C,  soot  was  blown  by  the  primary  and  there  was  a  heat  effect 
on  the  secondary. 
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(Left) 

Nozzle/ 
Primary 

200 

200 

X 
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31 

Dash  (  — )  denotes  no  anomaly. 
NA  denotes  not  applicable. 

NOTE:  A  list  of  the  sequence  of  launches  (1-25),  identified  by  STS  mission  designation,  is  pro- 
vided on  pages  4  thru  6. 


5  On  STS  51-G,  right  nozzle  had  erosion  in  two  places  on  the  primary  O-ring. 

6  On  STS  51-F,  right  nozzle  had  hot  gas  path  detected  in  putty  with  an  indication  of  heat  on  the 
primary  O-ring. 

7  On  STS  51-1,  left  nozzle  had  erosion  in  two  places  on  the  primary  O-ring. 
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This  last  entry  is  also  a  summary  of  the  briefing 
given  by  Thiokol  to  Lawrence  Mullen-  about  the 
41 -H  erosion  at  the  Level  III  Flight  Readiness 
Review  for  STS  41-C  held  at  Marshall  on  March 
8,  1984.  At  that  same  briefing,  the  Chief  Engineer 
for  United  Space  Boosters,  George  Morefield, 
raised  prior  Titan  experience  with  O-ring  prob- 
lems. He  explained  in  a  memorandum  to  Mulloy 
the  following  day: 

"I  alluded  to  the  Titan  III  SRM  history 
which  is  quite  similar  to  the  current  STS 
Solid  Rocket  Motor  experience.  Post-lire  in- 
spection of  Titan  Solid  Rocket  Motor  static 
test  motors  showed  that  pressurization  of  the 
single  O-rings  in  the  pressure  vessel  routine- 
ly occurred  via  a  single  break-down  path 
across  the  joint  putty.  There  was  also 
evidence  that  some  O-rings  never  see 
pressure  in  the  Titan  motor.  The  segment- 
to-segment  case  insulation  design  results  in 
a  compression  butt  joint  which  apparently 
is  often  sufficient  to  withstand  P(   .  .  .  . 

"Your  review  showed  that  there  was  suf- 
ficient margin  of  O-ring  remaining  to  do  the 
job.  I'm  sure  you  have  considered  that  if  it 
does  burn  through,  the  secondary  O-ring 
will  then  be  similarly  pressurized  through  a 
single  port.  So,  some  concern  remains. 

"I  recommend  that  you  set  up  a  panel  to 
study  the  use  of  putty  and  consider  some 
alternatives: 

*'l)  Is  putty  needed  at  all? 

"2)  If  the  tradition  can't  be  broken,  can 

the  putty  be  applied  with  multiple 

(6  or  8)  pressurization  paths  built 

in? 

"I  think  that  the  primary  seal  should  be 

allowed  to  work  in  its  classical  design  mode. 

Both    the   Titan    and    STS    Solid    Rocket 

Motors  have  been  designed  for  this  not  to 

happen.  Titan  has  flown  over  a  thousand 

pressure  joints  with  no  failure.  My  opinion 

is  that  the  potential  for  failure  of  the  joint 

is  higher  for  the  STS  Solid  Rocket  Motor, 

especially  when  occasionally  the  secondary 

seal  may  not  be  totally  effective."75 

When  the  41-B  erosion  was  taken  to  the  Level 

I  Flight  Readiness  Review  for  41-C  on  March 

30,  1984,  it  was  briefed  as  a  "technical  issue".  A 

recommendation  to  fly  41-C  was  approved  by 

Level  I  "accepting  the  possibility  of  some  O-ring 


erosion  due  to  the  hot  gas  impingement."  76  The 
rationale  for  acceptance  was  the  same  as  that 
given  at  the  Level  III  Flight  Readiness  Review 
and  entered  into  the  Marshall  problem  assess- 
ment report.  An  outgrowth  of  this  review  was  an 
April  5.  1984,  directive  from  NASA  Deputy  Ad- 
ministrator Dr.  Hans  Mark  to  Lawrence  Mulloy 
at  Marshall.  This  "Programmatic  Action  Item" 
was  signed  by  Weeks  and  asked  Mulloy  to  con- 
duct a  "formal  review  of  the  Solid  Rocket  Motor 
case-to-case  and  case-to-nozzle  joint  sealing  pro- 
cedures to  ensure  satisfactory  consistent  close- 
outs."  77  This  action  item  had  been  preceded  by 
a  letter  written  from  NASA  Associate  Ad- 
ministrator for  Space  Flight  General  Abraham- 
son  to  Marshall  Center  Director  Lucas.78  That 
letter,  sent  January'  18,  1984,  requested  that  Mar- 
shall develop  a  plan  of  action  to  make  improve- 
ment in  NASA's  ability  to  design,  manufacture 
and  fly  Solid  Rocket  Motors.  Abrahamson 
pointed  out  that  NASA  was  flying  motors  where 
basic  design  and  test  results  were  not  well 
understood.  The  letter  addressed  the  overall 
general  Solid  Rocket  Motor  design  but  did  not 
specifically  mention  O-ring  erosion. 

After  Mulloy  received  the  April  5,  1984  STS 
41-C  action  item  on  the  O-rings,  he  had 
Lawrence  Wear  forward  a  letter  to  Thiokol  which 
asked  for  a  formal  review  of  the  booster  field  joint 
and  nozzle  joint  sealing  procedures.  Thiokol  was 
to  identify  the  cause  of  the  erosion,  determine 
whether  it  was  acceptable,  define  necessary 
changes,  and  reevaluate  the  putty  then  in  use. 
The  Wear  letter  also  requested  small  motor  tests 
reflecting  joint  dynamics  as  well  as  analysis  of  the 
booster  assembly  process.79 

Thiokol  replied  to  the  Marshall  STS  41-C  ac- 
tion item  on  May  4,  1984,  with  a  program  plan 
entitled  "Protection  of  SRM  Primary  Motor 
Seals."  The  plan  was  prepared  by  Brian  Russell, 
then  Thiokol's  Manager  of  Systems  Engineering. 
It  outlined  a  systematic  program  to  isolate  the  O- 
ring  erosion  and  charring  problem  and  to 
eliminate  damage  to  the  joint  seals.80  Proposed 
areas  of  inquiry  included  the  leak  check  pressures, 
assembly  loads,  case  eccentricity  and  putty  layup. 
The  Thiokol  response  in  May  1984  was  merely 
a  proposal.  The  actual  final  response  to  the  direc- 
tive from  Marshall  was  not  completed  until  the 
August  19,  1985  briefing  on  the  Solid  Rocket 
Motor  seal  held  at  NASA  headquarters  some  15 
months  later.81 
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Leak  Check  and  Putty 

In  addition  to  the  action  item  from  NASA 
Headquarters,  another  result  of  the  41-B  erosion 
was  a  warning  written  by  John  Q.  Miller,  Mar- 
shall chief  of  the  solid  motor  branch,  to  George 
Hardy,  through  Keith  Coates.82  Miller  was  wor- 
ried about  the  two  charred  rings  on  41-B  and  the 
"missing  putty"  found  when  the  Solid  Rocket 
Boosters  were  recovered  and  disassembled.  He 
specifically  identified  the  putty's  sensitivity  to 
humidity  and  temperature  as  potential  sources 
of  problems.  "The  thermal  design  of  the  [Solid 
Rocket  Motor]  joints  depends  on  thermal  pro- 
tection of  the  O-ring  by  the  [putty],"  Miller  said. 
Failure  of  the  putty  to  "provide  a  thermal  bar- 
rier can  lead  to  burning  both  O-rings  and  subse- 
quent catastrophic  failure."  The  memorandum 
also  said  that  "the  O-ring  leak  check  procedure 
and  its  potential  effect  on  the  (putty)  installation 
and  possible  displacement  is  also  an  urgent  con- 
cern which  requires  expedition  of  previously  iden- 
tified full  scale  tests." 

From  the  beginning,  Thiokol  had  suspected  the 
putty  was  a  contributing  factor  in  O-ring  erosion, 
even  after  STS-2.83  In  April  1983,  Thiokol  re- 
ported on  tests  conducted  to  study  the  behavior 
of  the  joint  putty.  One  conclusion  of  the  report 
was  that  the  STS-2  erosion  was  probably  caused 
by  blow  holes  in  the  putty,  which  allowed  a  jet 


of  hot  gas  to  focus  on  a  point  on  the  primary  O- 
ring.  Thiokol  discovered  the  focused  jet  ate  away 
or  "impinged"  on  portions  of  the  O-ring.  Thiokol 
calculated  that  the  maximum  possible  impinge- 
ment erosion  was  .090  inch,  and  that  lab  test 
proved  that  an  O-ring  would  seal  at  3,000  psi 
when  erosion  of  .095  inches  was  simulated.  This 
"safety  margin"  was  the  basis  for  approving  Shut- 
tle flights  while  accepting  the  possibility  of  O-ring 
erosion.84 

Shortly  after  Miller's  routing  slip  to  Hardy 
about  the  "urgent  concern"  of  the  missing  putty 
on  41-B,  at  Thiokol,  Brian  Russell  authored  a 
letter  to  Robert  Ebeling  which  analyzed  the  ero- 
sion history  and  the  test  data.  Russell's  April  9, 
1984  conclusion  was  that  the  putty  itself  and  its 
layup  were  not  at  fault  but  that  the  higher 
stabilization  pressure  adopted  in  leak  check  pro- 
cedures, first  implemented  in  one  field  joint  on 
STS-9,  may  increase  the  chances  of  O-ring  ero- 
sion. The  conclusion  by  Miller  and  Russell  was 
that  the  air  pressure  forced  through  the  joint  dur- 
ing the  O-ring  leak  check  was  creating  more  putty 
blow  holes,  allowing  more  focused  jets  on  the 
primary  O-ring,  thereby  increasing  the  frequency 
of  erosion.85 

This  hypothesis  that  O-ring  erosion  is  related 
to  putty  blow  holes  is  substantiated  by  the  leak 
check  history  (Figure  3).  Prior  to  January,  1984, 
and  STS  41-B,  when  the  leak  check  pressure  was 
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50  or  100  psi.  only  one  field  joint  O-ring  anoma- 
ly had  been  found  during  the  first  nine  flights. 
However,  when  the  leak  check  stabilization 
pressure  was  officially  boosted  to  200  psi  for  STS 
41-B,  over  half  the  Shuttle  missions  experienced 
field  joint  O-ring  blow-by  or  erosion  of  some 
kind.86 

Moreover,  the  nozzle  O-ring  history  of  prob- 
lems is  similar.  The  nozzle  joint  leak  check  was 
changed  from  50  psi  to  100  psi  before  STS-9 
launched  in  November  1983.  After  this  change, 
the  incidence  of  O-ring  anomalies  in  the  nozzle 
joint  increased  from  12  percent  to  56  percent  of 
all  Shuttle  flights.  The  nozzle  pressure  was  in- 
creased to  200  psi  for  mission  51-D  in  April,  1985, 
and  51-G  in  June,  1985,  and  all  subsequent  mis- 
sions. Following  the  implementation  of  the  200 
psi  check  on  the  nozzle,  88  percent  of  all  flights 
experienced  erosion  or  blow-by.87 

Both  Thiokol  and  NASA  witnesses  agreed  that 
they  were  aware  that  the  increase  in  blow  holes 
in  the  putty  could  contribute  to  O-ring  erosion. 
The  Commission  testimony  of  May  2,  1986, 
reads: 

Dr.  Walker:  The  analysis  that  some  of  our 
staff  has  done  suggests  that  after  you  in- 
crease the  test  pressure  to  200  pounds,  the 
incidence  of  blow-by  and  erosion  actually 
increased. 

Mr.  Russell:  We  realized  that. 
Lawrence  Mulloy  was  also  questioned  about 
the  blow  holes  in  the  putty: 

Dr.  Walker:  Do  you  agree  that  the  primary 
cause  of  the  erosion  is  the  blow  holes  in  the 
puttv? 

Mr.  Mulloy:  I  believe  it  is.  Yes. 

Dr.  Walker:  And  so  your  leak  check  pro- 
cedure created  blow  holes  in  the  putty? 

Mr.  Mulloy:  That  is  one  cause  of  blow 
holes  in  the  putty. 

Dr.  Walker:  But  in  other  words,  your  leak 
check  procedure  could  indeed  cause  what 
was  your  primary  problem.  Didn't  that  con- 
cern you!' 

Mr.  Mulloy:  Yes,  sir.88 

Notwithstanding  the  knowledge  that  puttv 
blow  holes  caused  erosion  and  that  higher 
pressure  in  the  leak  check  caused  more  blow 
holes,    Thiokol   recommended   and   NASA   ac- 


(  epted  the  increased  pressure  to  ensure  that  the 
joint  actually  passed  the  integrity  tests.89 

The  documentary  evidence  produced  by 
NASA  and  Thiokol  demonstrates  that  Marshall 
was  very  concerned  about  the  putty  erosion/blow 
hole  problem  after  STS  41-B.  In  addition  to  John 
Millers  routing  slip  about  putty  on  STS  41-B 
discussed  above,  there  is  a  report  of  a  June  7. 
1984.  telephone  conference  between  Messrs. 
Thompson,  Coates  and  Ray  (Marshall)  and 
Messrs.  Saver.  Boisjoly.  Russell  and  Parker 
(Thiokol),  among  others.90  Marshall  told  Thiokol 
that  NASA  was  very  concerned  about  the  O-ring 
erosion  problem  and  that  design  changes  were 
necessary,  including  possible  putty  changes.  The 
Thiokol  engineers  discussed  Marshall's  sugges- 
tions after  the  telephone  conference,  but  decided 
they  could  not  agree  a  change  was  mandatory. 
A  follow-up  telephone  conference  was  held  be- 
tween Ben  Powers  of  Marshall  and  Lawrence 
Saver  of  Thiokol  on  July  2.  Powers  told  Saver 
that  NASA  would  not  accept  the  removal  of  the 
putty  from  the  joint  and  that  everyone  expected 
the  tests  to  show  that  gas  jets  would  damage  an 
O-ring.  However.  Powers  expressly  stated  that 
Marshall  would  not  accept  Thiokofs  opinion  that 
no  further  tests  were  necessary. 

In  mid- 1984,  the  early  tests  after  NASA's  ac- 
tion item  for  41-C  led  Thiokol  to  the  conclusion 
that  O-ring  erosion  was  a  function  of  the  putty 
blow  hole  size  and  the  amount  of  free  volume  be- 
tween the  putty  orifice  and  the  O-ring.  The 
damage  to  the  O-ring  was  judged  to  be  worse 
when  the  blow  hole  was  smaller  and  the  free 
volume  was  larger.91 

While  Thiokol  did  establish  plans  for  putty  tests 
to  determine  how  it  was  affected  by  the  leak  check 
in  response  to  the  41-C  action  item,  their  prog- 
ress in  completing  the  tests  was  slow.  The  action 
item  was  supposed  to  be  completed  by  May  30. 
1984,  but  as  late  as  March  6,  1985,  there  are 
Marshall  internal  memos  that  complain  that 
Thiokol  had  not  taken  any  action  on  Marshall's 
December  1983  directive  to  provide  data  on  putty 
behavior  as  affected  by  the  joint  leak  check 
stabilization  pressure.92 


STS  51-C  and  Cold  Temperature 

On  January  24.  1985,  STS  51-C  was  launched. 
The  temperature  of  the  O-rings  at  launch  was  53 
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know  knew  about."  93 
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".  .  .  If  I  had  known  .  .  .  I'm  sure  in  the 
'82  time  period  when  we  first  came  to  that 
conclusion  [that  the  seal  was  not  redun- 
dant], I  would  have  insisted  that  we  get 
busy  right  now  on  a  design  change  and 
also  look  for  any  temporary  fix  we  could 
do  to  improve  the  operation  of  the 
seal."  94 


James  Beggs 


Arnold  Aldrich 
Jesse  Moore 

Richard  Smith 

James  A.  Thomas 

Figure  4 


(Former)  NASA 
Administrator 


"I  had  no  specific  concerns  with  the  joint, 
the  O-rings  or  the  putty.  .  .  ."  95 


Manager,  National  Space 
Transportation  System 

(Former)  Associate  Admin- 
istrator for  Space  Flight 

Director,  Kennedy  Space    * 
Center 

Deputy  Director,  Kennedy 
Launch  and  Landing 
Operations 


None  were  aware  of  Thiokol's 
concern  about  negative  effect 
of  cold  temperature  on  O-ring  perform- 
ance, nor  were  they 
informed  of  the  same  concern 
raised  after  STS  51-C.96 


degrees,  the  coldest  to  that  date.  O-ring  erosion 
occurred  in  both  solid  boosters.  The  right  and  left 
nozzle  joint  showed  evidence  of  blow-by  between 
the  primary  and  secondary  O-rings.  The  primary 
O-ring  in  the  left  booster's  forward  field  joint  was 
eroded  and  had  blow-by,  or  soot  behind  the 
ring.97  The  right  booster's  damage  was  in  the 
center  field  joint  — the  first  time  that  field  joint 
seal  was  damaged.  Both  its  primary  and  second- 
ary O-rings  were  affected  by  heat,  and  the 
primary  ring  also  had  evidence  of  blow-by  of  soot 
behind  it.  This  was  also  the  first  flight  where  a 
secondary  O-ring  showed  the  effect  of  heat. 

STS  51-C  was  the  second  example  of  O-ring 
damage  in  flight  where  there  was  evidence  of 
blow-by  erosion  as  well  as  impingement  erosion. 
As  noted  previously,  impingement  erosion  occurs 
where  the  O-ring  has  already  sealed  and  a  focused 
jet  of  hot  gas  strikes  the  surface  of  the  ring  and 
removes  a  portion  of  it.  Blow-by  erosion  happens 


when  the  O-ring  has  not  yet  sealed  the  joint  gap 

and  the  edge  of  the  ring  erodes  as  the  hot  gas  flows 

around  it. 

Roger  Boisjoly  described  the  blow-by  erosion 

seen  in  51-C: 

"SRM  15  [STS  51-C]  actually  increased 
[our]  concern  because  that  was  the  first  time 
we  had  actually  penetrated  a  primary  O-ring 
on  a  field  joint  with  hot  gas,  and  we  had  a 
witness  of  that  event  because  the  grease  be- 
tween the  O-rings  was  blackened  just  like 
coal  .  .  .  and  that  was  so  much  more  signifi- 
cant than  had  ever  been  seen  before  on  any 
blow-by  on  any  joint  .  .  .  the  fact  was  that 
now  you  introduced  another  phenomenon. 
You  have  impingement  erosion  and  bypass 
erosion,  and  the  O-ring  material  gets  re- 
moved from  the  cross  section  of  the  O-ring 
much,  much  faster  when  you  have  bypass 
erosion  or  blow-by."98 
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Boisjoly  also  said  blow-by  erosion  was  where 
the  primary  0-ring"at  the  beginning  of  the  tran- 
sient cycle  ...  is  still  being  attacked  by  hot  gas, 
and  it  is  eroding  at  the  same  time  it  is  trying  to 
seal,  and  it  is  a  race  between,  will  it  erode  more 
than  the  time  allowed  to  have  it  seal."  He  describ- 
ed the  blow-by  on  51-C  as  "over  100  degrees  of 
arc,  and  the  blow-by  was  absolutely  jet  black.  It 
was  totally  intermixed  in  a  homogeneous  mixture 
in  the  grease."  When  the  blow-by  material  was 
chemically  analyzed,  Boisjoly  said,  "we  found  the 
products  of  putty  in  it,  we  found  the  products  of 
O-ring  in  it."99 

On  the  Marshall  problem  assessment  report 
that  was  started  to  track  field  joint  erosion  after 
STS  41-B,  the  STS  51-C  O-ring  anomaly  was  de- 
scribed as  "O-ring  burns  were  as  bad  or  worse 
than  previously  experienced  .  .  .  Design  changes 
are  pending  test  results."  10°  The  changes  being 
considered  included  modifying  the  O-rings  and 
adding  grease  around  the  O-rings  to  fill  the  void 
left  by  putty  blow  holes. 

On  January  31,  1985,  Marshall  Solid  Rocket 
Booster  Project  Manager  Mulloy  sent  an  urgent 
message  to  Lawrence  Wear  with  the  stated  sub- 
ject: "51-C  O-Ring  Erosion  Re:  51-E  FRR."  The 
message  ordered  that  the  Flight  Readiness 
Review  for  the  upcoming  flight: 

"Should  recap  all  incidents  of  O-ring  ero- 
sion, whether  nozzle  or  case  joint,  and  all 
incidents  where  there  is  evidence  of  flow  past 
the  primary  O-ring.  Also,  the  rationale  used 
for  accepting  the  condition  on  the  nozzle  O- 
ring.  Also,  the  most  probable  scenario  and 
limiting  mechanism  for  flow  past  the 
primary  on  the  51-C  case  joints.  If  [Thiokol] 
does  not  have  all  this  for  today  I  would  like 
to  see  the  logic  on  a  chart  with  blanks  [to 
be  filled  in]."101 

On  February  8,  1985,  Thiokol  presented  its 
most  detailed  analysis  to  date  of  the  erosion  prob- 
lems to  the  Solid  Rocket  Motor  project  office  at 
Marshall  for  what  was  then  called  Shuttle  mis- 
sion 51-E,  but  later  changed  to  51-D.  Thiokol  in- 
cluded a  report  on  damage  incurred  by  the  O- 
rings  during  flight  51-C  at  the  left  forward  and 
right  center  field  joints.  The  right  center  joint  had 
hot  gas  past  the  primary  O-ring.  Thiokol  said  that 
caused  a  concern  that  the  gas  seal  could  be  lost, 
but  iis  resolution  was  "accept  risk."102 

Thiokol  presented  test  results  showing  "max- 
imum expected  erosion"  and  "maximum  erosion 
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experienced'"  for  both  primary  and  secondary  O- 
rings  for  the  field  and  nozzle  joints.  Accepting 
damage  to  the  primary  O-ring  was  being  justified, 
in  part,  based  on  an  assumption  of  the  secondary 
O-ring  working  even  with  erosion.  However,  the 
Criticality  classification  indicated  the  primary  seal 
was  a  "single  point  failure."  During  this  flight 
readiness  assessment  at  Marshall,  for  the  first 
time  Thiokol  mentioned  temperature  as  a  factor 
in  O-ring  erosion  and  blow-by.  Thiokol  said  in 
its  conclusions  that  "low  temperature  enhanced 
probability  of  blow-by  — [flight]  51-C  experienced 
worst  case  temperature  change  in  Florida 
history."  Thiokol  concluded  that  while  the  next 
Shuttle  flight  "could  exhibit  same  behavior," 
nonetheless  "the  condition  is  not  desirable  but  is 
acceptable."  103 

At  the  Level  I  Flight  Readiness  Review  con- 
ducted on  February  21,  there  was  no  detailed 
analysis  of  O-ring  problems  presented  or  any 
reference  made  to  low  temperature  effects.  Instead, 
a  single  reference  indicated  the  O-ring  erosion  and 
blow-by  experienced  was  "acceptable"  because  of 
"limited  exposure  time  and  redundancy." 

STS  51-B  and 

the  Launch  Constraint 

Joint  seal  problems  occurred  in  each  of  the  next 
four  Shuttle  flights.  Flight  51-D,  launched  April 
12,  1985  had  nozzle  O-ring  erosion  and  blow-by 
on  an  igniter  joint.  STS  51-B,  launched  17  days 
later,  experienced  both  nozzle  O-ring  erosion  and 
blow-by  as  did  51-G,  which  flew  on  the  follow- 
ingjune  17.  STS  51-F,  launched  July  29,  1985 
had  nozzle  O-ring  blow-by.104 

In  reponse  to  the  apparent  negative  effect  of 
cold  leading  to  the  extensive  O-ring  problems  on 
flight  51-C  in  January,  Thiokol  conducted  some 
O-ring  resiliency  tests  in  early  1985. 105  The  tests 
were  conducted  to  quantify  the  seal  timing  func- 
tion of  the  secondary  O-ring  and  the  effect  of  joint 
rotation  on  its  ability  to  back  up  the  primary  ring. 
The  key  variable  was  temperature.  The  June  3 
test  report,  which  was  described  in  an  August  9, 
1985  letter  from  Brian  Russell  at  Thiokol  to  Jim 
Thomas  at  Marshall,  showed: 

"Bench  test  data  indicates  that  the  O-ring 
resiliency  (its  capability  to  follow  the  metal) 
is  a  function  of  temperature  and  rate  of  case 
expansion.  [Thiokol]  measured  the  force  of 
the  O-ring  against  Instron  platens,  which 


simulated  the  nominal  squeeze  on  the  O-ring 
and  approximated  the  case  expansion 
distance  and  rate. 

"At  100°F,  the  O-ring  maintained  contact. 
At  75°F  the  O-ring  lost  contact  for  2.4 
seconds.  At  50°F,  the  O-ring  did  not  re- 
establish contact  in  ten  minutes  at  which 
time  the  test  was  terminated."106 

On  June  25,  1985,  the  left  nozzle  joint  of  STS 
51-B  (launched  April  29)  was  disassembled  and 
inspected  after  it  had  been  shipped  back  to 
Thiokol.  What  Thiokol  found  was  alarming.  The 
primary  O-ring  seal  had  been  compromised 
because  it  eroded  .171  inches  and  it  did  not  seal. 
The  secondary  O-ring  did  seal,  but  it  had  erod- 
ed .032  inches.  Lawrence  Mulloy  described  the 
51-B  problem  as  follows: 

"This  erosion  of  a  secondary  O-ring  was 
a  new  and  significant  event  .  .  .  that  we  cer- 
tainly did  not  understand.  Everything  up  to 
that  point  had  been  the  primary  O-ring, 
even  though  it  had  experienced  some  ero- 
sion does  seal.  What  we  had  evidence  of  was 
that  here  was  a  case  where  the  primary  O- 
ring  was  violated  and  the  secondary  O-ring 
was  eroded,  and  that  was  considered  to  be 
a  more  serious  observation  than  previously 
observed  .  .  . 107 

"What  we  saw  [in  51-B],  it  was  evident 
that  the  primary  ring  never  sealed  at  all,  and 
we  saw  erosion  all  the  way  around  that  O- 
ring,  and  that  is  where  the  .171  came  from, 
and  that  was  not  in  the  model  that  predicated 
a  maximum  of  .090,  the  maximum  of  .090 
is  the  maximum  erosion  that  can  occur  if  the 
primary  O-ring  seals. 

"But  in  this  case,  the  primary  O-ring  did 
not  seal;  therefore,  you  had  another  volume 
to  fill,  and  the  flow  was  longer  and  it  was 
blow-by  and  you  got  more  erosion."108 

Upon  receiving  the  report  of  the  51-B  primary 
ring  failure,  Solid  Rocket  Booster  Project 
Manager  Mulloy  and  the  Marshall  Problem 
Assessment  Committee  placed  a  "launch  con- 
straint" on  the  Shuttle  system.109  A  1980  Mar- 
shall letter  which  references  "Assigning  Launch 
Constraints  on  Open  Problems  Submitted  to 
MSFC  PAS"  defines  launch  constraint  as: 

"All  open  problems  coded  Criticality  1, 
1R,  2,  or  2R  will  be  considered  launch  con- 
straints until  resolved  (recurrence  control 


established  and  its  implementation  effectivity 
determined)  or  sufficient  rationale,  i.e.,  dif- 
ferent configuration,  etc.,  exists  to  conclude 
that  this  problem  will  not  occur  on  the  flight 
vehicle  during  pre-launch,  launch,  or 
flight."110 

Lawrence  Mulloy  told  the  Commission  that  the 
launch  constraint  was  "put  on  after  we  saw  the 
secondary  O-ring  erosion  on  the  [51-B]  nozzle." 
"Based  on  the  amount  of  charring,"  the  problem 
report  listing  the  constraint  said,  "the  erosion 
paths  on  the  primary  O-ring  and  what  is 
understood  about  the  erosion  phenomenon,  it  is 
believed  that  the  primary  O-ring  [of  the  joint] 
never  sealed."  ni  The  constraint  applied  to  STS 
51-F  and  all  flights  subsequent,  including  STS 
51-L.  Although  one  Marshall  document  says  that 
the  constraint  applied  to  all  O-ring  anomalies,112 
no  similar  launch  constraint  was  noted  on  the 
Marshall  Problem  Assessment  Report  that  started 
tracking  the  field  joint  erosion  after  STS  41-B. 
Thiokol  officials  who  testified  before  the  Com- 
mission all  claimed  they  were  not  aware  of  the 
July  1985  launch  constraint;113  however,  Thiokol 
letters  referenced  Marshall  Record  number 
A09288,  the  report  that  expressly  identified  the 
constraint.114 

After  the  launch  constraint  was  imposed,  Proj- 
ect Manager  Mulloy  waived  it  for  each  Shuttle 
flight  after  July  10,  1985.  Mr.  Mulloy  and  Mr. 
Lawrence  Wear  outlined  the  procedure  in  the 
following  manner: 

Chairman  Rogers:  To  you,  what  does  a 
constraint  mean,  then? 

Mr.  Mulloy:  A  launch  constraint  means 
that  we  have  to  address  the  observations,  see 
if  we  have  seen  anything  on  the  previous 
flight  that  changes  our  previous  rationale, 
and  address  that  at  the  Flight  Readiness 
Review. 

Chairman  Rogers:  When  you  say  "address 
it,"  I  always  get  confused  by  the  word.  Do 
you  mean  think  about  it?  Is  that  what  you 
mean? 

Mr.  Mulloy:  No,  sir.  I  mean  present  the 
data  as  to  whether  or  not  what  we  have  seen 
in  our  most  recent  observation,  which  may 
not  be  the  last  flight,  it  may  be  the  flight 
before  that,  is  within  our  experience  base 
and  whether  or  not  the  previous  analysis  and 
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tests  that  previously  concluded  that  was  an 
acceptable  situation  is  still  valid,  based  upon 
later  observations.   .  .  . 

The  constraint  was  put  on  after  we  saw 
the  secondary  O-ring  erosion  on  the  nozzle, 
I  believe. 

Chairman  Rogers:  Who  decided  that? 

Mr.  Mulloy:  I  decided  that,  that  that  would 
be  addressed,  until  that  problem  was  re- 
solved, it  would  be  considered  a  launch  con- 
straint, and  addressed  at  Flight  Readiness 
Reviews  to  assure  that  we  were  staying 
within  our  test  experience  base.  .  .  . 

Chairman  Rogers:  Do  you  have  ultimate 
responsibility  for  waiving  the  launch 
constraints? 

Mr.  Mulloy:  Yes.  sir.  I  have  ultimate 
responsibility  for  the  launch  readiness  of  the 
Solid  Rocket  Boosters. 

Chairman  Rogers:  So  there  was  a  launch 
constraint,  and  you  waived  it. 

Mr.  Mulloy:  Yes.  sir.  all  flights  subsequent 
to.  .  .  . 

Dr.  Ride:  I'm  trying  to  understand  how  you 
deal  with  the  launch  constraint.  How  im- 
portant do  you  think  a  launch  constraint  is 
and  how  unusual  is  it  in  your  system? 

Mr.  Wear:  I  think  a  launch  constraint  is  a 
significant  event  in  our  system,  and  it  is  one 
that  has  to  be  addressed  within  the  Flight 
Readiness  cycle  because  I  don't  have  the 
authority  to  not  do  that.  .  .  . 

Dr.  Ride:  Why  didn't  you  put  a  launch  con- 
straint on  the  field  joint  at  the  same  time? 

Mr.  Mulloy:  I  think  at  that  point,  and  I  will 
react  to  that  question  in  real  time,  because 
I  haven't  really  thought  about  it,  but  I  think 
the  logic  was  that  we  had  been  observing  the 
field  joint,  the  field  and  nozzle  joint  primary 
O-ring  erosion.  This  erosion  of  a  secondary 
O-ring  was  a  new  and  significant  event,  very 
new  and  significant  even  that  we  certainly 
did  not  understand.  Everything  up  to  that 
point  had  been  that  the  primary  O-ring, 
even  though  it  had  experienced  some  ero- 
sion,  does  seal.  What  we  had  evidence  of 
was  that  here  was  a  case  where  the  primary 
O-ring  was  violated  and  the  secondary  O- 


ring  was  eroded,  and  that  was  considered 
to  be  a  more  serious  observation  than 
previously  observed. 

Dr.  Ride:  Correct  me  if  I  am  wrong,  but 
weren't  you  basing  most  of  your  decisions 
on  the  field  joint  on  analysis  of  what  was  the 
maximum,  what  you  believed  to  be  the 
maximum  possible  erosion,  and  you  had 
that  analysis  for  the  field  joint  and  for  the 
nozzle  joint.  When  you  saw  the  complete 
erosion  of  the  primary  O-ring  on  the  noz- 
zle joint,  that  showed  you  that  your  analysis 
on  the  nozzle  joint  wasn't  any  good.  I  would 
think.  That  would  indicate  to  you  that  your 
analysis  on  the  field  joint  wasn't  very  good, 
either,  or  at  least  should  be  suspect. 

Mr.  Mulloy:  The  conclusion,  rightly  or 
wrongly,  for  the  cause  of  the  secondary  O- 
ring  erosion  on  the  nozzle  joint,  it  was  con- 
cluded from  test  data  we  had  that  100  psi 
pressurization  leak  check,  that  the  putty 
could  mask  a  primary  O-ring  that  was  not 
sealing.  The  conclusion  was  — and  that  one 
was  done  at  100  psi.  The  conclusion  was  that 
in  order  to  get  that  type  of  erosion  that  we 
saw  on  the  primary  O-ring,  that  that  O-ring 
never  sealed,  and  therefore  the  conclusion 
was  that  it  never  was  capable  of  sealing. 
The  leak  check  on  subsequent  nozzles,  all 
subsequent  nozzles  was  run  at  200  psi,  which 
the  test  data  indicated  would  always  blow- 
through  the  putty,  and  in  always  blowing 
through  the  putty  we  were  guaranteed  that 
we  had  a  primary  O-ring  seal  that  was 
capable  of  sealing,  and  then  we  further  did. 
and  we  already  had  that  on  the  field  joints 
at  that  time.115 

While  Mulloy  and  Wear  both  testified  that  the 
constraint  was  still  in  effect  and  waived  for 
Challenger's  flight,  they  told  the  Commission  that 
there  had  been  two  erroneous  entries  on  the  O- 
ring  erosion  nozzle  problem  assessment  report 
stating  the  O-ring  erosion  problem  had  been 
resolved  or  closed. ' 16  Thiokol  had  suggested  this 
closure  on  December  10,  1985  (at  Marshall's  re- 
quest according  to  Brian  Russell)  but  Wear  and 
Mulloy  told  the  Commission  they  rejected  that 
recommendation  and  the  problem  was  still  be- 
ing addressed  in  Flight  Readiness  Reviews.117 
NASA  Levels  I  and  II  apparently  did  not  realize 
Marshall  had  assigned  a  launch  constraint  within 
the  Problem  Assessment  Svstem.118  This  com- 
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General  Conclusions 

•  All  O-ring  erosion  has  occurred  where  gas  paths  in  the 
vacuum  putty  are  formed 

•  Gas  paths  in  the  vacuum  putty  can  occur  during 
assembly,  leak  check,  or  during  motor  pressurization 

•  Improved  filler  materials  or  layup  configurations  which 
still  allow  a  valid  leak  check  of  the  primary  O-rings  may 
reduce  frequency  of  O-ring  erosion  but  will  probably  not 
eliminate  it  or  reduce  the  severity  of  erosion 

•  Elimination  of  vacuum  putty  in  a  tighter  joint  area  will 
eliminate  O-ring  erosion  if  circumferential  flow  is  not 
present — if  it  is  present,  some  baffle  arrangement  may  be 
required 

•  Erosion  in  the  nozzle  joint  is  more  severe  due  to  eccen- 
tricity; however,  the  secondary  seal  in  the  nozzle  will  seal 
and  will  not  erode  through 

•  The  primary  O-ring  in  the  field  joint  should  not  erode 
through  but  if  it  leaks  due  to  erosion  or  lack  of  sealing  the 
secondary  seal  may  not  seal  the  motor 

•  The  igniter  Gask-O-Seal  design  is  adequate  providing 
proper  quality  inspections  are  made  to  eliminate  overfill 
conditions 


Figure  5 


Recommendations 

•  The  lack  of  a  good  secondary  seal  in  the  field  joint  is  most 
critical  and  ways  to  reduce  joint  rotation  should  be  incor- 
porated as  soon  as  possible  to  reduce  criticality 

•  The  flow  conditions  in  the  joint  areas  during  ignition  and 
motor  operation  need  to  be  established  through  cold  flow 
modeling  to  eliminate  O-ring  erosion 

•  QM-5  static  test  should  be  used  to  qualify  a  second 
source  of  the  only  flight  certified  joint  filler  material 
(asbestos-filled  vacuum  putty)  to  protect  the  flight  pro- 
gram schedule 

•  VLS-1  should  use  the  only  flight  certified  joint  filler 
material  (Randolph  asbestos-filled  vacuum  putty)  in  all 
joints 

•  Additional  hot  and  cold  subscale  tests  need  to  be  con- 
ducted to  improve  analytical  modeling  of  O-ring  erosion 
problem  and  for  establishing  margins  of  safety  for  eroded 
O-rings 

•  Analysis  of  existing  data  indicates  that  it  is  safe  to  con- 
tinue flying  existing  design  as  long  as  all  joints  are  leak 
checked  with  a  200  psig  stabilization  pressure,  are  free  of 
contamination  in  the  seal  areas  and  meet  O-ring  squeeze 
requirements 

•  Efforts  need  to  continue  at  an  accelerated  pace  to 
eliminate  SRM  seal  erosion 


munication  failure  was  contrary  to  the  require- 
ment, contained  in  the  NASA  Problem  Report- 
ing and  Corrective  Action  Requirements  System, 
that  launch  constraints  were  to  be  taken  to  Level 
II. 

Escalating  Concerns 

When  the  burn  through  of  the  primary  nozzle 
O-ring  on  the  left  Solid  Rocket  Booster  of  STS 
51-B  was  discovered  in  Utah  on  June  25,  1985, 
an  engineer  from  the  NASA  headquarters  Shut- 
tle Propulsion  Group  was  on  the  scene.  Three 
days  after  the  51-B  inspection,  a  memorandum 
was  written  to  Michael  Weeks,  also  at  Head- 
quarters, reporting  on  the  primary  O-ring  burn 
through.119  The  memo  blamed  the  problem  on 
the  faulty  100  psi  leak  check  and  reminded  Weeks 
that  Thiokol  had  not  yet  responded  to  the  O-ring 
erosion  action  item  sent  out  after  STS  41 -B  one 
year  earlier. 

Engineers  at  Thiokol  also  were  increasingly 
concerned  about  the  problem.  On  July  22,  1985, 
Roger  Boisjoly  of  the  structures  section  wrote  a 
memorandum  predicting  NASA  might  give  the 
motor  contract  to  a  competitor  or  there  might  be 
a  flight  failure  if  Thiokol  did  not  come  up  with 
a  timely  solution.120 

Nine  days  later  (July  31)  Boisjoly  wrote  another 
memorandum  titled  "O-ring  Erosion/Potential 


Failure  Criticality"  to  R.  K.  Lund,  Thiokol's  Vice 
President  of  Engineering: 

"The  mistakenly  accepted  position  on  the 
joint  problem  was  to  fly  without  fear  of 
failure  and  to  run  a  series  of  design  evalua- 
tions which  would  ultimately  lead  to  a  solu- 
tion or  at  least  a  significant  reduction  of  the 
erosion  problem.  This  position  is  now 
changed  as  a  result  of  the  [51-B]  nozzle  joint 
erosion  which  eroded  a  secondary  O-ring 
with  the  primary  O-ring  never  sealing.  If  the 
same  scenario  should  occur  in  a  field  joint 
(and  it  could),  then  it  is  a  jump  ball  whether 
as  to  the  success  or  failure  of  the  joint 
because  the  secondary  O-ring  cannot  re- 
spond to  the  clevis  opening  rate  and  may  not 
be  capable  of  pressurization.  The  result 
would  be  a  catastrophe  of  the  highest 
order  — loss  of  human  life." 

Boisjoly  recommended  setting  up  a  team  to 
solve  the  O-ring  problem,  and  concluded  by 
stating: 

"It  is  my  honest  and  very  real  fear  that  if 
we  do  not  take  immediate  action  to  dedicate 
a  team  to  solve  the  problem,  with  the  field 
joint  having  the  number  one  priority,  then 
we  stand  in  jeopardy  of  losing  a  flight  along 
with  all  the  launch  pad  facilities."121 
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In  reply  to  specific  questions  from  Marshall  on 

August  9.  Thiokol's  Brian  Russell  reported  the 
test  data  on  the  June  3  resiliency  tests.  As  noted 
previously,  he  indicated  O-ring  resiliency  was  a 
function  of  the  temperature  and  case  expansion. 
Also,  he  wrote,  Thiokol  had  no  reason  to  suspect 
that  the  primary  O-ring  would  fail  after  motor 
ignition  transient.  He  said  the  secondary  O-ring 
would  seal  within  the  period  after  ignition  from 
0  to  170  milliseconds.122  From  170  to  330  milli- 
seconds, the  probability  of  the  sealing  of  the 
secondary  O-ring  was  reduced.  From  330  to  600 
milliseconds,  there  was  only  a  slight  chance  the 
secondary  seal  would  hold. 

On  August  19,  1985,  Thiokol  and  Marshall 
program  managers  briefed  NASA  Headquarters 
on  erosion  of  the  motor  pressure  seals.123  The 
briefing  paper  concluded  that  the  O-ring  seal  was 
a  critical  matter,  but  it  was  safe  to  fly.  The  brief- 
ing was  detailed,  identifying  all  prior  instances  of 
field  joint,  nozzle  joint  and  igniter  O-ring  erosion. 
It  recommended  an  "accelerated  pace"  to  elimi- 
nate seal  erosion  but  concluded  with  the  recom- 
mendation that  "it  is  safe  to  continue  flying  ex- 
isting design  as  long  as  all  joints  are  leak  checked 
with  a  200  psig  stabilization  pressure,  are  free  of 
contamination  in  the  seal  areas  and  meet  O-ring 
squeeze  requirements."  The  briefing  conclusions 
and  recommendations  appear  in  Figure  5.124 

Thiokol's  Robert  Lund,  Vice  President  — Engi- 
neering, noting  that  "the  result  of  a  leak  at  any 
of  the  joints  would  be  catastrophic,"  announced 
the  establishment  of  a  Thiokol  O-ring  task  force 
on  August  20,  1985,  to  "investigate  the  Solid 
Rocket  Motor  case  and  nozzle  joints,  both 
materials  and  configurations,  and  recommend 
both  short-term  and  long-term  solutions."  125 

Two  days  later,  A.  R.  Thompson,  Thiokol's 
supervisor  of  structures  design,  said  in  a 
memorandum  to  S.  R.  Stein,  project  engineer, 
that  the  "O-ring  seal  problem  has  lately  become 
acute."  Thompson  recommended  near-term  solu- 
tions of  increasing  the  thickness  of  shims  used  at 
the  tang  and  clevis  mating,  and  increasing  the 
diameter  of  the  O-ring.  "Several  long-term  solu- 
tions look  good;  but,  several  years  are  required 
to  incorporate  some  of  them,"  Thompson  wrote. 
"The  simple  short-term  measures  should  be  taken 
to  reduce  flight  risks."  126  During  a  Commission 
hearing.  Thompson  was  asked  about  the  larger 
diameter  ( )-ring  solution: 

Dr.  Walker:  Why  didn't  you  go  to  the  larger 
O-ring,  then? 
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Mr.  Thompson:  One  problem  in  going  to 
larger  O-rings  is  in  field  joints  —  plant  joints, 
excuse  me.  In  the  plant  joints,  if  you  put 
in  the  295  and  you  take  the  worst  on  worst, 
when  the  joint  is  raised  to  a  temperature  of 
325  degrees  during  the  curing  of  the  insula- 
tion, it  is  an  overfill  condition  because  of  the 
alpha  problems  with  the  case,  and  the 
rubber. 

Dr.  Walker:  There  is  no  reason  why  a  field 
joint  and  a  plant  joint  had  to  have  the  same 


O 


ring,  is  there 


Mr.  Thompson:  There  were  some  that 
were  afraid  of  the  QC  people,  that  were 
afraid  of  the  confusion  that  might  be 
developed   between   two   nearly   the   same 


size 
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Thiokol's  revised  O-ring  protection  plan,  dated 
August  30,  1985,  indicated  that  NASA  and 
Thiokol  were  still  not  in  agreement  on  the 
magnitude  of  the  joint  rotation  phenomenon.  It 
said  that  "presently  there  are  conflicting  data  from 
Solid  Rocket  Motor  case  hydrotest  and  [static 
tests]  concerning  the  magnitude  of  case  field  joint 
rotation  under  motor  pressure.  A  referee  test  will 
be  devised,  which  is  mutually  acceptable  to 
NASA  and  Thiokol,  to  determine  joint  opening 
characteristics."  128 


Design  Questions  Resurface 

Also  in  late  August,  Thiokol  submitted 
"Preliminary  Solid  Rocket  Motor  Nozzle/Field 
Joint  Seal  Concepts"  to  NASA,  which  were  "for- 
mulated to  solve  the  [Solid  Rocket  Motor]  seal- 
ing problems."  The  document  contained  43  pos- 
sible design  concepts  for  field  joints  and  20  for 
nozzle  joints.  The  report  said  Thiokol  "feels  the 
case  field  joint  poses  the  greatest  potential  risk 
in  that  its  secondary  seal  may  not  maintain  metal 
contact  throughout  motor  operation.  The  nozzle 
joint  is  also  of  major  concern  because  the  frequen- 
cy and  severity  of  seal  damage  experienced  has 
been  greater  than  any  other  joint." 

In  September  1985,  Thiokol's  plans  called  for 
test-firing  a  static  motor  with  various  O-ring  con- 
figurations. In  a  September  10  presentation  to 
Marshall,  Thiokol  discussed  erosion  predictions, 
and  evaluated  primary  engineering  concerns  in- 
cluding joint  deflection  and  secondary  O-ring 
resiliency.  Temperature  was  not  mentioned.129 


Prior  to  that  Thiokol  presentation,  Marshall 
Science  and  Engineering  Director  Kingsbury  had 
informed  Solid  Rocket  Booster  Program 
Manager  Mulloy: 

"I  am  most  anxious  to  be  briefed  on  plans 
for  improving  the  Solid  Rocket  Motor  CD- 
ring  seals.  Specifically,  I  want  to  review- 
plans  which  lead  to  flight  qualifications  and 
the  attendant  schedules.  I  have  been  ap- 
prised of  general  ongoing  activities  but  these 
do  not  appear  to  carry  the  priority  which  I 
attach  to  this  situation.  I  consider  the  O-ring 
seal  problem  on  the  Solid  Rocket  Motor  to 
require  priority  attention  of  both  Morton 
Thiokol/Wasat'ch  and  MSFC."130 

Early  in  October,  internal  warnings  about  the 
lack  of  results  from  the  O-ring  task  force  came 
when  Thiokol's  management  got  two  separate 
memoranda  complaining  about  administrative 
delays  and  lack  of  cooperation.  One  memoran- 
dum was  written  by  Roger  Boisjoly  on  October 
4,  1985,  and  it  warned  Thiokol  management 
about  lack  of  management  support  of  the  O-ring 
team's  efforts.131  He  said  that  "even  NASA 
perceives  that  the  team  is  being  blocked  in  its 
engineering  efforts  to  accomplish  its  task.  NASA 
is  sending  an  engineering  representative  to  stay 
with  us  starting  October  14th.  We  feel  that  this 
is  the  direct  result  of  their  feeling  that  we 
[Thiokol]  are  not  responding  quickly  enough  on 
the  seal  problem." 

R.  V.  Ebeling,  manager  of  Thiokol's  Solid 
Rocket  Motor  ignition  system,  began  his  October 
1,  1985,  report  to  McDonald  with  the  alarming 
word  "HELP!"  Ebeling  said  the  seal  task  force  was 
"constantly  being  delayed  by  every  possible 
means."  "Marshall  Space  Flight  Center,"  he  said, 
"is  correct  in  stating  that  we  do  not  know  how 
to  run  a  development  program."  Ebeling  con- 
tinued: 

"The  allegiance  to  the  O-ring  investiga- 
tion task  force  is  very  limited  to  a  group  of 
engineers  numbering  8-10.  Our  assigned 
people  in  manufacturing  and  quality  have 
the  desire,  but  are  encumbered  with  other 
significant  work.  Others  in  manufacturing, 
quality,  procurement  who  are  not  involved 
directly,  but  whose  help  we  need,  are 
generating  plenty  of  resistance.  We  are 
creating  more  instructional  paper  than 
engineering  data.  We  wish  we  could  get  ac- 


tion by  verbal  request,  but  such  is  not  the 
case.  This  is  a  red  flag."132 

Shuttle  flight  61-A  was  launched  October  30, 
1985.  It  experienced  nozzle  O-ring  erosion  and 
field  joint  O-ring  blow-by.133  These  anomalies 
were  not  mentioned  at  the  Level  I  Flight  Readi- 
ness Review  for  flight  61-B.  That  flight  was 
launched  on  November  26,  1985,  and  sustained 
nozzle  O-ring  erosion  and  blow-by.134 

The  following  month  (December)  Thiokol's 
problem  status  report  which  tracked  the  field  joint 
erosion  anomaly  stated  that  the  O-ring  task  force 
had  made  one  hot  gas  test  and  preliminary  results 
indicated  the  test  chamber  needed  to  be  re- 
designed.135 Mr.  Ebeling  of  Thiokol  became  so 
concerned  about  the  gravity  of  the  O-ring  prob- 
lem that  he  told  fellow  members  of  the  seal  task 
force  that  he  believed  Thiokol  should  not  ship  any 
more  motors  until  the  problem  was  fixed. 

In  testimony  before  the  Commission,  Ebeling 
said: 

Mr.  Ebeling:  Well,  I  am  a  hydraulics  engi- 
neer by  profession,  and  O-rings  and  seals 
and  hydraulics  are  very  sacred,  but  for  the 
most  part,  a  hydraulics  or  pneumatics  engi- 
neer controls  the  structure,  the  structural 
design,  the  structural  deformation  to  make 
sure  that  this  neat  little  part  that  is  so  critical 
is  given  every  thing  it  needs  to  operate.  In 
Solid  Rocket  Motors  I  have  been  there  now 
pushing  25  years.  They  had  a  different  at- 
titude on  O-rings  when  I  came  there,  and 
it  is  not  just  Thiokol,  it  is  universal. 

Dr.  Covert:  By  universal,  you  mean  the 
solid  rocket  industry? 

Mr.  Ebeling:  The  entire  solid  rocket  in- 
dustry. It  gets  around  from  one,  the  com- 
petitors' information  eventually  gets  to  me 
by  one  track  or  another,  and  mine  to  them, 
but  my  experience  on  O-rings  was  and  is 
to  this  date  that  the  O-ring  is  not  a 
mechanism  and  never  should  be  a 
mechanism  that  sees  the  heat  of  the 
magnitude  of  our  motors,  and  I  think  before 
I  do  retire,  I'm  going  to  make  sure  that  we 
discontinue  to  fly  with  round  seals  which  I 
am  against  round  seals  anyway.  I  think  seals 
with  memories,  not  pressure-activated,  but 
energized  through  mechanical  means,  and 
in  all  cases,   keep  the  heat  of  our  rocket 


141 


motors  away  from  those  seals.  Whatever  it 
is,  you  do  not  need  chamber  pressure  to 
energize  a  seal. 

Dr.  Covert:  In  this  regard,  then,  did  you 
have  an  increasing  concern  as  you  saw  the 
tendency  first  to  accept  thermal  distress  and 
then  to  say,  well,  we  can  model  this 
reasonably  and  we  can  accept  a  little  bit  of 
erosion,  and  then  etc.,  etc.?  Did  this  cause 
you  a  feeling  of  if  not  distress,  then  betrayal 
in  terms  of  your  feeling  about  O-rings? 

Mr.  Ebeling:  I'm  sure  sorry  you  asked  that 

question. 

Mr.  Covert:  I'm  sorry  I  had  to. 

Mr.  Ebeling:  To  answer  your  question, 
ves.  In  fact,  I  have  been  an  advocate,  I  used 
to  sit  in  on  the  O-ring  task  force  and  was 
involved  in  the  seals  since  Brian  Russell 
worked  directly  for  me,  and  I  had  a  certain 
allegiance  to  this  type  of  thing  anyway,  that 
I  felt  that  we  shouldn't  ship  any  more  rocket 
motors  until  we  got  it  fixed. 

Dr.  Covert:  Did  you  voice  this  concern? 

Mr.  Ebeling:  Unfortunately,  not  to  the 
right  people.136 

The  Closure  Issue 

On  December  6,  1985,  Thiokol's  Brian  Russell 
wrote  Al  McDonald,  Thiokol  Solid  Rocket  Motor 
Project  Director,  requesting  "closure  of  the  Solid 
Rocket  Motor  O-ring  erosion  critical  prob- 
lems." I37  He  gave  17  reasons  for  the  closure,  in- 
cluding test  results,  future  test  plans  and  the  work 
to  date  of  Thiokol's  task  force.  Four  days  later 
(December  10)  McDonald  wrote  a  memorandum 
to  NASA's  Wear  asking  for  closure  of  the  O-ring 
problem.  All  O-ring  erosion  problems,  including 
the  problem  containing  the  July  1985  launch  con- 
straint, were  among  the  referenced  matters  that 
Thiokol  suggested  should  be  closed.  McDonald 
noted  that  the  O-ring  problem  would  not  be  fully 
resolved  for  some  time,  and  he  enclosed  a  copy 
of  Thiokol's  August  30  plan  for  improving  the 
motor  seals.138 

Brian  Russell  described  the  problem  tracking 
process  and  gave  the  reason  for  the  closure  recom- 
mendation during  the  following  exchange: 

Mr.  Russell:  We  have  our  reliability 
engineering  department,  who  is  responsible 


to  complete  the  monthly  problem  report,  and 
in  addition  to  that  we  have  our  monthly 
problem  review  board  telephone  conference 
with  NASA  and  the  contractors,  of  which 
we  are  a  part,  and  the  monthly  problem 
review  or  the  monthly  problem  report  that 
reliability  prepares,  they  get  the  information 
from  engineering  or  from  the  office  as  neces- 
sary to  complete  their  status  of  what  has  hap- 
pened during  that  month,  whether  the  prob- 
lem originated  that  month  or  what  has  been 
done  to  close  the  problem  out.  and  that  is 
submitted  every  month,  and  I  for  one  do 
review  that  before  it  is  submitted  to  the 
Marshall  Space  Flight  Center,  and  so  much 
of  the  information  that  I  would  read  in  these 
reports  would  be  the  same  information  that 
we  had  given  in  that  monthly  problem 
report  or  over  the  telephone  on  the  tele- 
conference. 

Chairman  Rogers:  Mr.  Russell,  when  you 
say  close  the  problem  out,  what  do  you 
mean  by  that?  How  do  you  close  it  out 
normally? 

Mr.  Russell:  Normally,  whether  it  takes 
engineering  analysis  or  tests  or  some  cor- 
rective action,  a  closeout  to  the  problem 
would  occur  after  an  adequate  corrective  ac- 
tion had  been  taken  to  satisfy  those  on  the 
problem  review  board  that  the  problem  had 
indeed  been  closed  out.  That  is  the  way  that 
that  happens;  for  example,  we  had  found  a 
loose  bolt  on  the  recovery  one  time,  and  we 
had  to  take  corrective  action  in  our  pro- 
cedures and  in  the  engineering  to  make  sure 
that  that  wouldn't  happen  again,  and  then 
to  verify  that  corrective  action,  and  at  that 
point  that  problem  would  be  ready  to  be 
closed  out.  It  generally  involves  a  report  or 
at  least  a  mention  by  the  review  board 
stating  what  had  been  done  to  adequately 
close  it  out,  and  then  it  is  agreed  upon  by 
the  parties  involved.  .  .  . 

Question:  What  do  you  understand  a 
launch  constraint  to  mean? 

Mr.  Russell:  My  understanding  of  a  launch 
constraint  is  that  the  launch  cannot  proceed 
without  adequately —  without  everyone's 
agreement  that  the  problem  is  under 
control. 
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Chairman  Rogers:  Under  control  meaning 
what?  You  just  said  a  moment  ago  that  you 
would  expect  some  corrective  action  to  be 
taken. 

Mr.  Russell:  That  is  correct,  and  in  this 
particular  case  on  this  51-B  nozzle  O-ring 
erosion  problem  there  had  been  some  cor- 
rective action  taken,  and  that  was  included 
in  the  presentation  made  as  a  special  adden- 
dum to  the  next  Flight  Readiness  Review, 
and  at  the  time  we  did  agree  to  continue  to 
launch,  which  apparently  had  lifted  the 
launch  constraint,  would  be  my  under- 
standing. .  .  . 

Chairman  Rogers:  But  really  my  question 
is:  Did  you  gentlemen  realize  that  it  was  a 
launch  constraint? 

Mr.  Russell:  I  would  like  to  answer  for 
myself.  I  didn't  realize  that  there  was  a  for- 
mal launch  constraint  on  this  one,  any  dif- 
ferent than  some  of  the  other  erosion  and 
blow-by  that  we  had  seen  in  the  past. 

Mr.  Ebeling:  I  agree.  .  .  . 

Question:  .  .  .  Mr.  Russell,  you  wrote  a 
letter,  did  you  not,  or  a  memorandum  in- 
dicating that  the  problem  should  be  closed. 
Could  you  explain  to  the  Commission 
what  you  meant  by  that? 

Mr.  Russell:  Yes.  In  our  December 
telephone  call  on  the  Problem  Review 
Board  — and  I  can't  remember  the  date  — it 
was  around  the  9th  or  so  — there  was  a  re- 
quest to  close  the  problems  out  and  par- 
ticularly the  ones  that  had  been  open  for  a 
long  time,  of  which  this  was  one,  and  a  long 
time  meaning  six  months  or  more. 

There  was  a  request  from  the  Director  of 
Engineering,  as  I  recall  it,  that  we  close  these 
problems  out.  .  .  . 

Dr.    Walker:    That   was   the   Director  of 

Engineering  at  Marshall? 

Mr.  Russell:  Yes,  at  Marshall  Space  Flight 
Center.  Now,  he  wasn't  in  that  call.  My 
understanding  is  what  they  told  us  and  my 
recollection  was  that  Mr.  Kingsbury  would 
like  to  see  these  problems  closed  out. 

Now,  the  normal  method  of  closing  them 
out  is  to  implement  the  corrective  action, 
verify  the  corrective  action,  and  then  the 


problem  is  closed,  it  comes  off  the  board  and 
is  no  longer  under  active  review.  .  .  . 

Chairman  Rogers:  What  was  being  done 
to  fix  it? 

Mr.  Russell:  Well,  we  had  a  task  force 
created  of  full-time  people  at  Thiokol,  of 
which  I  was  a  member  of  that  task  team, 
and  we  had  done  some  engineering  tests. 
We  were  trying  to  develop  concepts.  We  had 
developed  some  concepts  to  block  the  flow 
of  hot  gas  against  the  O-ring  to  the  point 
where  the  O-ring  would  no  longer  be 
damaged  in  a  new  configuration. 

And  we  had  run  some  cold  gas  tests  and 
some  hot  gas  motor  firing  tests  and  were 
working  toward  a  solution  of  the  problem 
and  we  had  some  meetings  scheduled  with 
the  Marshall  Space  Flight  Center.  We  had 
weekly  telephone  calls  where  we  statused  our 
progress  and  there  was  a  team  at  Marshall 
also  of  engineering  people  who  were 
monitoring  the  things  that  we  were  doing  to 
fix  the  problem  with  the  goal  of  implement- 
ing a  fix  in  our  qualification  motor  No.  5, 
which  was  scheduled  at  that  time  in  January, 
this  timeframe  being  about  the  December 
timeframe  of  last  year. 

Chairman  Rogers:  Can  I  interrupt?  So 
you're  trying  to  figure  out  how  to  fix  it, 
right?  And  you're  doing  some  things  to  try 
to  help  you  figure  out  how  to  fix  it. 

Now,  why  at  that  point  would  you  close 
it  out?  .  .  . 

Mr.  Russell:  Because  I  was  asked  to  do  it. 

Chairman  Rogers:  I  see.  Well,  that  ex- 
plains it. 

Mr.  Rummel:  It  explains  it,  but  really 
doesn't  make  any  sense.  On  one  hand  you 
close  out  items  that  you've  been  reviewing 
flight  by  flight,  that  have  obviously  critical 
implications,  on  the  basis  that  after  you  close 
it  out,  you're  going  to  continue  to  try  to  fix 
it. 

So  I  think  what  you're  really  saying  is, 
you're  closing  it  out  because  you  don't  want 
to  be  bothered.  Somebody  doesn't  want  to 
be  bothered  with  flight-by-flight  reviews,  but 
you're  going  to  continue  to  work  on  it  after 
it's  closed  out.139 
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Marshall  received  the  Thiokol  letter  asking  for 
the  closure  and  an  entry  was  placed  on  all  Mar- 
shall Problem  Reports  referenced  in  McDonald's 
December  10  letter  indicating  "contractor  closure 
received"  on  December  18,  1985. I40  On  January 
23,  1986,  another  entry  was  placed  on  the  same 
reports  indicating  the  "problem  is  considered 
closed."  141  Lawrence  Mulloy  and  Lawrence  Wear 
testified  those  entries  were  "in  error."  They  said: 

Mr.  Mulloy:  The  problem  assessment 
system  was  put  in  place  to  provide  visibility 
throughout  the  Shuttle  system  for  the  types 
of  problems  that  do  occur,  not  just  in  flight, 
but  also  in  qualification  tests,  and  in  failure 
of  hardware  that  is  back  for  refurbishment 
at  a  vendor  or  whatever.  And  it  is  a  closed 
loop  tracking  system  that  lists  the 
anomaly.  .  .  . 

Now,  the  entry  that  is  shown  in  there  that 
the  problem  was  closed  prior  to  51-L  is  in 
error.  What  happened  there  was,  one  of  your 
documents  here  which  we  did  not  discuss  is 
the  letter  from  Mr.  McDonald  to  Mr.  Wear 
which  proposed  that  this  problem  be 
dropped  from  the  problem  assessment 
system  and  no  longer  be  tracked  for  the 
reasons  stated  in  Mr.  McDonald's  letter. 

That  letter  was  in  the  review  cycle.  The 
letter,  I  believe,  was  dated  10  December 
1985.  It  came  into  the  center,  it  was  in  the 
review  cycle.  After  Mr.  Wear  brought  this 
letter  to  my  attention,  my  reaction  was,  we 
are  not  going  to  drop  this  from  the  problem 
assessment  system  because  the  problem  is 
not  resolved  and  it  has  to  be  dealt  with  on 
a  flight-by-flight  basis. 

Since  that  was  going  through  the  review 
cycle,  the  people  who  run  this  problem 
assessment  system  erroneously  entered  a 
closure  for  the  problem  on  the  basis  of  this 
submittal  from  Thiokol.  Having  done  that 
then  for  the  51-L  review,  this  did  not  come 
up  in  the  Flight  Readiness  Review  as  an 
open  launch  constraint,  so  you  won't  find  a 
project  signature  because  the  PAS  system 
showed  the  problem  was  closed,  and  that  was 
an  error. 

Chairman  Rogers:  Who  made  the  error? 
Do  you  know0 

Mr.  Mulloy:  The  people  who  do  the  prob- 
lem assessment  system. 


Mr.  Wear:  Mr.  Fletcher,  and  he  reports 
within  our  quality  organization  at  the  Flight 
Readiness  Reviews,  ...  as  I  think  have 
been  described  to  you  before.  There  is  one 
from  Thiokol  to  me,  and  there  is  one  from 
my  group  to  Larry,  and  then  Larry,  of 
course,  does  one  with  the  Shuttle  project  of- 
fice, and  so  forth,  on  up  the  line.  At  my 
review  and  at  Larry's  review,  here  is  a  heads 
up  given  to  the  quality  representative  at  that 
board  for  what  problems  the  system  has 
open,  and  they  cross-check  to  make  sure  that 
we  address  that  problem  in  the  readiness 
review. 

On  this  particular  occasion,  there  was  no 
heads  up  given  because  their  Problem 
Assessment  System  considered  that  action 
closed.  That  is  unfortunate.142 

Project  Manager  Mulloy  was  asked  during 
Commission  hearings  about  the  original  response 
to  O-ring  erosion: 

Mr.  Hotz:  Mr.  Mulloy,  I  would  like  to  try 
to  understand  this  in  somewhat  simpler 
terms  than  you  people  are  used  to  using. 
Is  it  correct  to  state  that  when  you 
originally  designed  this  joint  and  looked  at 
it,  that  you  did  not  anticipate  erosion  of  any 
of  the  O-ring  during  flights? 

Mr.  Mulloy:  That  is  my  understanding.  I 
entered  this  program  in  November  of  1982 
and  I  wasn't  there  on  the  original  design  of 
the  joint,  but  when  I  took  over  the  program 
there  was  no  O-ring  erosion  anticipated. 

Mr.  Hotz:  So  that  when  you  did  run  into 
signs  of  O-ring  erosion,  this  was  a  bad  sign. 

Mr.  Mulloy:  Yes,  sir.  .  .  . 

Mr.  Hotz:  So  then  you  decided  to  introduce 
a  standard  based  on  the  measurement  or  the 
possibility  of  the  limits  of  O-ring  erosion. 
And  as  those  limits,  as  the  experience  went 
up,  your  criteria  for,  say,  flight  went  up  too. 
In  other  words,  when  you  experienced 
more  than  maximum  anticipated  O-ring 
erosion,  you  waived  the  flight  and  said 
"Well,  it's  possible  to  tolerate  that.  We  still 
have  a  margin  left." 

Mr.  Mulloy:  Are  you  speaking  of  the  case 
where  we  did  not  have  a  primary  seal. 

Mr.  Hotz:  Yes. 
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Mr.  Mulloy:  Yes,  sir.  That  is  correct.  .  .  . 

Mr.  Hotz:  Then  you  finally,  you're  talking 
about  these  margins  of  safety,  and  I  wonder 
if  you  could  express  in  either  percentages  or 
actual  measurement  terms  — you  have  used 
the  term  "wide  margin."  I  wonder  if  you 
could  give  us  a  quantitative  measurement  as 
to  what  you  consider  a  wide  margin? 

Mr.  Mulloy:  Yes,  sir.  Well,  as  I  said  we  had 
demonstrated  that  we  could  stand  125 
thousandths  of  erosion  and  still  seat.  The 
maximum  erosion  that  we  had  seen  in  the 
case  joint  was  on  STS-2,  which  was  53 
thousandths,  so  that  is  a  factor  of  two  and 
a  half  ... 

Dr.  Keel:  ...  I  think,  Larry,  if  you  go  back 
and  look  at  your  Flight  Readiness  Reviews, 
that  you  were  relying  on  less  margins  than 
that. 

You  were  arguing  in  the  Flight  Readiness 
Reviews  where  you  briefed  the  problems  of 
primary  O-ring  erosion  that  for  the  worst 
case  for  the  field  joint  also  that  it  would  be 
90  thousandths. 

Mr.  Mulloy:  That  is  correct. 

Dr.  Keel:  At  that  point  you  were  pointing 
out  that's  okay,  because  you  can  seal  at  95, 
not  at  125  but  at  95.  It  wasn't  until  later  on 
during  the  process  that  you  determined  you 
could  seal  at  125. 

Mr.  Mulloy:  That  is  when  we  got  the  hot 
gas  test  data. 

Dr.  Keel:  So  that's  a  five  percent  margin, 
roughly,  five  and  a  half. 

Mr.  Mulloy:  On  the  90  to  95  on  a  max 
predictable,  yes.143 


Temperature  Effects 


The  record  of  the  fateful  series  of  NASA  and 
Thiokol  meetings,  telephone  conferences,  notes, 
and  facsimile  transmissions  on  January  27th,  the 
night  before  the  launch  of  flight  51-L,  shows  that 
only  limited  consideration  was  given  to  the  past 
history  of  O-ring  damage  in  terms  of  tempera- 
ture. The  managers  compared  as  a  function  of 
temperature  the  flights  for  which  thermal  distress 
of  O-rings  had  been  observed  — not  the  frequen- 


cy of  occurrence  based  on  all  flights  (Figure  6  ). 
In  such  a  comparison,  there  is  nothing  irregular 
in  the  distribution  of  O-ring  "distress"  over  the 
spectrum  of  joint  temperatures  at  launch  between 
53  degrees  Fahrenheit  and  75  degrees  Fahrenheit. 
When  the  entire  history  of  flight  experience  is 
considered,  including  "normal"  flights  with  no 
erosion  or  blow-by,  the  comparison  is  substan- 
tially different  (Figure  7). 

This  comparison  of  flight  history  indicates  that 
only  three  incidents  of  O-ring  thermal  distress  oc- 
curred out  of  twenty  flights  with  O-ring 
temperatures  at  66  degrees  Fahrenheit  or  above, 
whereas,  all  four  flights  with  O-ring  temperatures 
at  63  degrees  Fahrenheit  or  below  experienced 
O-ring  thermal  distress. 

Consideration  of  the  entire  launch  temperature 
history  indicates  that  the  probability  of  O-ring 
distress  is  increased  to  almost  a  certainty  if  the 
temperature  of  the  joint  is  less  than  65. 


Flight  Readiness  Reviews 

It  is  clear  that  contractor  and  NASA  program 
personnel  all  believed  that  the  O-ring  ero- 
sion/blow-by anomaly,  and  even  the  launch  con- 
straint, were  problems  that  should  be  addressed 
in  NASA's  Flight  Readiness  Review  process.  The 
Flight  Readiness  Review  is  a  multi-tiered  review 
that  is  designed  to  create  an  information  flow 
from  the  contractor  up  through  Level  III  at  Mar- 
shall, then  to  Level  II  officials  from  Johnson  and 
Level  I  at  Headquarters.  With  regard  to  the  Solid 
Rocket  Booster,  the  process  begins  at  the  element 
level  and  culminates  in  a  coordinated  Marshall 
position  at  the  subsequent  Levels  II  and  I  Flight 
Readiness  Review.144 

NASA  policy  manuals  list  four  objectives  of  the 
Shuttle  Projects  Flight  Readiness  Review,  an  in- 
termediate review  between  Level  III  and  Level 
I,  when  contractors  and  Level  III  program  per- 
sonnel consider  the  upcoming  launch.  The  stated 
objectives  are: 

"1.  To  provide  the  review  team  with  suffi- 
cient information  necessary  for  them  to 
make  an  independent  judgment  regard- 
ing flight  readiness. 

"2.  Review  solved  problems  and  previous 
flight  anomalies  and  establish  confidence 
in  solution  rationale. 
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"3.   Address  all  problems,  technical  issues, 
open    items    and    constraints    requiring 
resolution  before  flight. 
"4.    Establish  the  flight  baseline  configuration 
particularly  as  it  differs  from  previous 
missions."  145 
The  Commission   has  reviewed  the  various 
documentary  presentations  made  by  Thiokol  and 
NASA   program   people   for   Flight    Readiness 
Reviews  on  all  Shuttle  flights.  The  O-ring  presen- 
tations in  those  Flight  Readiness  Reviews  have 
been  summarized  in  an  Appendix  to  this  report. 
The  erosion  on  STS-2  was  not  considered  on 
any  level  of  the  Flight  Readiness  Review  for 
STS-3.146  Similarly   the   heat  effect  on  STS-6's 
primary  O-ring  in  the  nozzle  was  not  mentioned 
on  the  STS-7  Flight  Readiness  Review  in  1983. 
However,   the  rationale  for  acceptance  of  the 
"secondary  seal  condition"  for  the  lightweight  case 
first  flown  on  STS-6  contained  the  observation 
that  an  O-ring  sealed  during  a  Thiokol  test  under 
3,000  psi  where  .125  inches  had  been  cut  out  of 
the  O-ring.147 

The  inattention  to  erosion  and  blow-by  anoma- 
ly changed  when  Thiokol  filed  a  problem  report 
on  the  field  joint  erosion  after  STS  41 -B.  The  O- 
ring  problems  (field  and  nozzle)  on  41 -B  were 
briefed  as  a  "technical  issue"  in  the  41-C  Flight 
Readiness  Review.  "Probable  causes"  were  de- 
fined as: 

"Putty  blow-through  at  ignition  causes 
cavity  between  putty  and  primary  O-ring  to 
fill  during  pressurization.  Inability  of  putty 
to  withstand  motor  pressure.  Air  entrapment 
in  putty  during  mating.  Blow  holes  in  putty 
during  joint  leak  test." 
Thiokol  presented  the  question  at  its  41-C  pre- 
board  to  Marshall,  "If  primary  O-ring  allowed 
a  hot  gas  jet  to  pass  through,  would  the  second- 
ary O-ring  survive  impingement?"148  At  the  41-C 
Level  I  Flight  Readiness  Review,  on  March  30, 
1984,  Marshall  said  the  erosion  phenomenon  was 
"acceptable"  and  that  blow  holes  in  the  putty  were 
the  "most  probable  cause."  The  rationale  for  the 
acceptance  of  the  possibility  of  erosion  on  STS 
41-C  was: 

"Conservative  analysis  indicates  max  erosion 
possible: 

".090  in.  (field  joint) 
".090  in.  (nozzle  joint) 

"Laboratory  test  of  full  scale  O-ring/joint 
cross  section  shows  capability  to  sustain  joint 


sealing  integrity  at  3,000  psi  pressure  using 
an  O-ring  with  a  simulated  .095  in.  erosion 
depth. 

"Recommendation : 

"Fly  STS  41-C  accepting  possibility  of  some 
O-ring  gas  impingement."  149 

The  next  significant  treatment  of  the  problem 
occurred  after  the  coldest  flight,  51-C  at  53 
degrees  in  January  1985.  In  part,  Thiokol's  ex- 
tensive analysis  for  the  51-E  Flight  Readiness 
Review  was  due  to  the  fact  that  four  joints  on 
51-C  had  problems.150  Additionally,  Mr. 
Mulloy's  specific  request  for  a  recap  of  the  O-ring 
history  undoubtedly  prompted  a  full  treatment. 
Temperature  was  highlighted  as  a  concern  when 
Mulloy  took  Thiokol's  analysis  up  to  the  Shuttle 
Projects  Office  Flight  Readiness  Review.  That 
18-page  briefing  concluded  with  the  statement 
that:  "STS  51-C  consistent  with  erosion  data 
based.  Low  temperature  enhanced  probability  of 
blow-by.  STS-51-C  experienced  worst  case 
temperature  change  in  Florida  history.  STS  51-E 
could  exhibit  the  same  behavior.  Condition  is 
acceptable."151 

At  the  Level  I  Flight  Readiness  Review  for 
51-E  on  February  21,  1985,  the  previous  18-page 
analysis  had  been  reduced  to  a  one  page  chart 
with  the  resolution:  "acceptable  risk  because  of 
limited  exposure  and  redundancy  (Ref.  STS  41-C 
FRR)".152  No  mention  of  temperature  was  found 
in  the  Level  I  report. 

The  last  major  discussion  of  erosion  was  at  the 
Level  I  Flight  Readiness  Review  for  STS  51-F 
(July  2,  1985). 153  An  analysis  of  the  failure  of  the 
nozzle  primary  O-ring  to  seal  due  to  erosion  on 
flight  STS  51-B  (April  29,  1985)  was  presented. 
This  serious  erosion  was  attributed  to  leak  check 
procedures.  An  increase  in  the  nozzle  leak  check 
to  200  psi  was  proposed  to  be  a  cure.  There  was 
no  mention  of  the  fact  that  .171  inches  of  ero- 
sion on  the  primary  O-ring  far  exceeded  a  more 
recent  analysis  model  prediction  of  .070  inches 
maximum  possible  erosion.  This  was  a  revision 
of  the  former  prediction  of  .090  inches.  The 
launch  constraint  activated  after  STS  51-B  was 
not  specifically  listed  in  the  Level  I  Flight 
Readiness  Review  for  51-F.  The  Commission  has 
also  not  found  any  mention  of  the  July  1985  con- 
straint, or  its  waiver  for  subsequent  Shuttle 
flights,  in  any  Flight  Readiness  Review  briefing 
documents. 
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The  Commission's  review  of  the  Marshall  and 
Thiokol  documentary  presentations  at  the  various 
Flight  Readiness  Reviews  revealed  several  signifi- 
cant trends.  First,  O-ring  erosion  was  not  con- 
sidered early  in  the  program  when  it  first  occur- 
red. Second,  when  the  problem  grew  worse  after 
STS  41-B,  the  initial  analysis  of  the  problem  did 
not  produce  much  research;  instead,  there  was 
an  early  acceptance  of  the  phenomenon.  Third, 
because  of  a  belief  that  in-flight  O-ring  erosion 
was  "within  the  data  base"  of  prior  experience, 
later  Flight  Readiness  Reviews  gave  a  cursory 
review  and  often  dismissed  the  recurring  erosion 
as  within  "acceptable"  or  "allowable"  limits. 
Fourth,  both  Thiokol  and  Marshall  continued  to 
rely  on  the  redundancy  of  the  secondary  O-ring 
long  after  NASA  had  officially  declared  that  the 
seal  was  a  non-redundant  single  point  failure. 
Finally,  in  1985  when  temperature  became  a  ma- 
jor concern  after  STS  51-C  and  when  the  launch 
constraint  was  applied  after  51-B.  NASA  Levels 
I  and  II  were  not  informed  of  these  developments 
in  the  Flight  Readiness  Review  process. 


Findings 

The  genesis  of  the  Challenger  accident  — the 
failure  of  the  joint  of  the  right  Solid  Rocket 
Motor  — began  with  decisions  made  in  the  design 
of  the  joint  and  in  the  failure  by  both  Thiokol  and 
NASA's  Solid  Rocket  Booster  project  office  to 
understand  and  respond  to  facts  obtained  dur- 
ing testing. 

The  Commission  has  concluded  that  neither 
Thiokol  nor  NASA  responded  adequately  to  in- 
ternal warnings  about  the  faulty  seal  design.  Fur- 
thermore, Thiokol  and  NASA  did  not  make  a 
timely  attempt  to  develop  and  verify  a  new  seal 
after  the  initial  design  was  shown  to  be  deficient. 
Neither  organization  developed  a  solution  to  the 
unexpected  occurrences  of  O-ring  erosion  and 
blow-by  even  though  this  problem  was  experi- 
enced frequently  during  the  Shuttle  flight  history. 
Instead,  Thiokol  and  NASA  management  came 
to  accept  erosion  and  blow-by  as  unavoidable  and 
an  acceptable  flight  risk.  Specifically,  the  Com- 
mission has  found  that: 

1.   The  joint  test  and  certification  program 
was  inadequate.  There  was  no  require- 


ment to  configure  the  qualifications  test 
motor  as  it  would  be  in  (light,  and  the 
motors  were  static  tested  in  a  horizontal 
position,  not  in  the  vertical  flight 
position. 

2.  Prior  to  the  accident,  neither  NASA  nor 
Thiokol  fully  understood  the  mechanism 
by  which  the  joint  sealing  action  took 
place. 

3.  NASA  and  Thiokol  accepted  escalating 
risk  apparently  because  they  "got  away 
with  it  last  time."  As  Commissioner 
Feynman  observed,  the  decision  making 
was: 

"a  kind  of  Russian  roulette.  .  .  . 
[The  Shuttle]  flies  [with  O-ring  ero- 
sion] and  nothing  happens.  Then  it 
is  suggested,  therefore,  that  the  risk 
is  no  longer  so  high  for  the  next 
flights.  We  can  lower  our  standards 
a  little  bit  because  we  got  away  with 
it  last  time.  .  .  .  You  got  away  with 
it,  but  it  shouldn't  be  done  over  and 
over  again  like  that."154 

4.  NASA's  system  for  tracking  anomalies  for 
Flight  Readiness  Reviews  failed  in  that, 
despite  a  history  of  persistent  O-ring  ero- 
sion and  blow-by,  flight  was  still  per- 
mitted. It  failed  again  in  the  strange  se- 
quence of  six  consecutive  launch  con- 
straint waivers  prior  to  51-L,  permitting 
it  to  fly  without  any  record  of  a  waiver. 
or  even  of  an  explicit  constraint.  Track- 
ing and  continuing  only  anomalies  that 
are  "outside  the  data  base"  of  prior  flight 
allowed  major  problems  to  be  removed 
from,  and  lost  by,  the  reporting  system. 

5.  The  O-ring  erosion  history  presented  to 
Level  I  at  NASA  Headquarters  in 
August  1985  was  sufficiently  detailed  to 
require  corrective  action  prior  to  the  next 
flight. 

6.  A  careful  analysis  of  the  flight  history  of 
O-ring  performance  would  have  revealed 
the  correlation  of  O-ring  damage  and  low- 
temperature.  Neither  NASA  nor  Thiokol 
carried  out  such  an  analysis;  consequent- 
ly, they  were  unprepared  to  properly 
evaluate  the  risks  of  launching  the  51-L 
mission  in  conditions  more  extreme  than 
thev  had  encountered  before.  ■ 
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Chapta   I'll 


The  Silent  Safety 
Program 


The  Commission  was  surprised  to 
realize  alter  many  hours  of  testimony 
that  NASA's  safety  staff  was  never 
mentioned.  No  witness  related  the 
approval  or  disapproval  of  the  reliability 
engineers,  and  none  expressed  the  satisfaction  or 
dissatisfaction  of  the  quality  assurance  staff.  No 
one  thought  to  invite  a  safety  representative  or 
a  reliability  and  quality  assurance  engineer  to  the 
January  27,  1986.  teleconference  between  Mar- 
shall and  Thiokol.  Similarly,  there  was  no 
representative  of  safety  on  the  Mission  Manage- 
ment Team  that  made  key  decisions  during  the 
countdown  on  January  28,  1986.  The  Commis- 
sion is  concerned  about  the  symptoms  that  it  sees. 
The  unrelenting  pressure  to  meet  the  demands 
of  an  accelerating  flight  schedule  might  have  been 
adequately  handled  by  NASA  if  it  had  insisted 
upon  the  exactingly  thorough  procedures  that 
were  its  hallmark  during  the  Apollo  program.  An 
extensive  and  redundant  safety  program  com- 
prising interdependent  safety,  reliability  and 
quality  assurance  functions  existed  during  and 
after  the  lunar  program  to  discover  any  poten- 
tial safety  problems.  Between  that  period  and 
1986,  however,  the  program  became  ineffective. 
This  loss  of  effectiveness  seriously  degraded  the 
(hecks  and  balances  essential  for  maintaining 
llight  safety. 

On  April  3,  1986,  Arnold  Aldrich,  the  Space 
Shuttle  program  manager,  appeared  before  the 
( lommission  at  a  public  hearing  in  Washington, 
D.C.  He  described  five  different  communication 
or  organization  failures  that  affected  the  launch 
decision  on  January  28,  1986. '  Four  of  those 
failures  relate  directly  to  faults  within  the  safety 
program.  These  faults  include  a  lack  of  problem 
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reporting  requirements,  inadequate  trend 
analysis,  misrepresentation  of  criticality  and  lack 
of  involvement  in  critical  discussions.2  A  properly 
staffed,  supported,  and  robust  safety  organiza- 
tion might  well  have  avoided  these  faults  and  thus 
eliminated  the  communication  failures. 

NASA  has  a  safety  program  to  ensure  that  the 
communication  failures  to  which  Mr.  Aldrich 
referred  do  not  occur.  In  the  case  of  mission  51-L. 
that  program  fell  short. 


NASA's  Safety  Program 

The  NASA  Safety,  Reliability  and  Quality 
Assurance  Program  should  play  an  important  role 
in  agency  activities,  for  the  three  concerns  in- 
dicated in  the  program  title  are  its  functions.  In 
general  terms,  the  program  monitors  the  status 
of  equipment,  validation  of  design,  problem 
analysis  and  system  acceptability.  Each  of  these 
has  flight  safety  implications. 

More  specifically,  safety  includes  the  prepara- 
tion and  execution  of  plans  for  accident  preven- 
tion, flight  system  safety  and  industrial  safety  re- 
quirements. Within  the  Shuttle  program,  safety 
analyses  focus  on  potential  hazards  and  the  assess- 
ment of  acceptable  risks. 

Reliability  refers  to  processes  for  determining 
that  particular  components  and  systems  can  be 
relied  on  to  work  as  planned.  One  product  of  such 
processes  is  a  Critical  Items  List  that  identifies 
how  serious  the  failure  of  a  particular  item  or 
system  would  be. 

Quality  assurance  is  closely  related  to  both  safe- 
ty and  reliability.  All  NASA  elements  prepare 


plans  and  institute  procedures  to  insure  that  high 
standards  of  quality  are  maintained.  To  ac- 
complish that  goal,  elements  charged  with  respon- 
sibility for  quality  assurance  establish  procedural 
controls,  assess  inspection  programs,  and  par- 
ticipate in  a  problem  identification  and  reporting 
system. 

The  Chief  Engineer  at  NASA  Headquarters, 
has  overall  responsibility  for  safety,  reliability  and 
quality  assurance.  The  ability  of  the  Chief 
Engineer  to  manage  NASA's  safety  program  is 
limited  by  the  structure  of  safety,  reliability  and 
quality  assurance  organizations  within  the  agen- 
cy. His  limited  staff  of  20  persons3  includes  only 
one  who  spends  25  percent  of  his  time  on  Shut- 
tle maintainability,  reliability  and  quality 
assurance  and  another  who  spends  10  percent  of 
his  time  on  these  vital  aspects  of  flight  safety.4 

At  Johnson,  a  large  number  of  government  and 
contractor  engineers  support  the  safety,  reliability 
and  quality  assurance  program,  but  needed  ex- 
pertise concerning  Marshall  hardware  is  absent. 
Thus  the  effectiveness  of  the  oversight  respon- 
sibilities at  Level  II  was  limited.5 

Kennedy  has  a  myriad  of  safety,  reliability  and 
quality  assurance  organizations.  In  most  cases, 
these  organizations  report  to  supervisors  who  are 
responsible  for  processing.  The  clear  implication 
of  such  a  management  structure  is  that  it  fails  to 
provide  the  kind  of  independent  role  necessary 
for  flight  safety. 

At  Marshall,  the  director  of  Reliability  and 
Quality  Assurance  reports  to  the  director  of 
Science  and  Engineering  who  oversees  the 
development  of  Shuttle  hardware.  Again,  this 
results  in  a  lack  of  independence  from  the  pro- 
ducer of  hardware  and  is  compounded  by  reduc- 
tions in  manpower,6  the  net  bringing  about  a 
decrease  in  effectiveness  which  has  direct  implica- 
tions for  flight  safety. 

Monitoring  Safety  Critical  Items 

As  part  of  the  safety,  reliability  and  quality 
assurance  effort,  components  of  the  Shuttle 
system  are  assigned  to  criticality  categories  as 
follows: 

Criticality  1  Loss  of  life  or  vehicle  if  the 
component  fails. 

Criticality  2  Loss  of  mission  if  the  com- 
ponent fails. 


Criticality  3       All  others. 

Criticality  1R    Redundant  components,  the 

failure  of  both  could  cause 

loss  of  life  or  vehicle. 
Criticality  2R    Redundant  components,  the 

failure  of  both  could  cause 

loss  of  mission. 

The  assignment  of  criticality  follows  a  highly 
detailed  analysis  of  each  Space  Shuttle  compo- 
nent to  determine  the  effect  of  various  ways  the 
component  could  fail.  This  analysis  always 
assumes  the  most  adverse  conditions  with  the 
most  conservative  assumptions.  Any  component 
that  does  not  meet  the  fail-safe  design  require- 
ment is  designated  a  Criticality  1  item  and  must 
receive  a  waiver  for  use.  A  Critical  Items  List  is 
produced  that  contains  information  about  all 
Criticality  1  components.  The  Solid  Rocket 
Booster  Critical  Items  List  entry  for  the  field  joint, 
dated  December  17,  1982  is  an  example  of  this 
process. 

Component  criticality  is  related  to  test  re- 
quirements in  the  Operational  Maintenance  Re- 
quirements and  Specifications  Document  pub- 
lished and  maintained  by  Level  II  at  Johnson. 
For  the  Orbiter,  the  references  from  the  Critical 
Items  List  to  the  requirements  and  specifications 
document  are  complete  and  traceable  in  both 
directions.  The  Solid  Rocket  Booster  Critical 
Items  List,  however,  does  not  include  references 
to  the  requirements  and  specifications  document.7 
Such  references  would  make  the  Critical  Items 
List  a  more  efficient  management  tool  for  track- 
ing activities  concerned  with  items  critical  for 
flight  safety. 

The  next  step  in  procedures  documentation  is 
the  Operations  and  Maintenance  Instruction, 
which  develops  the  directives  into  step-by-step 
procedures  used  at  Kennedy  by  technicians,  in- 
spectors and  test  personnel  to  accomplish  each 
step  of  the  hardware  preparations  for  flight.  The 
current  Operations  and  Maintenance  Instruction 
does  not  indicate  the  criticality  level  of 
components. 

If  the  Operations  and  Maintenance  Instruction 
clearly  indicated  when  the  work  to  be  performed 
related  to  a  Criticality  1  component,  all  concerned 
would  be  alerted  that  a  higher  than  normal  level 
of  care  should  be  used.  The  same  point  applies 
to  production  activities  at  Thiokol  where  criticali- 
ty should  be  directly  incorporated  into  manufac- 
turing quality  planning. 
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Problem  Reporting 


Prior  to  1983.  Level  III  was  required  to  report 
all  problems,  trends,  and  problem  closeout  ac- 
tions to  Level  II  unless  the  problem  was 
associated  with  hardware  that  was  not  flight- 
critical.8  Unfortunately,  this  requirement  was 
substantially  reduced  to  include  only  those  prob- 
lems which  dealt  with  common  hardware  items 
or  physical  interlace  elements.  The  revision 
eliminated  reporting  on  flight  safety  problems, 
flight  schedule  problems,  and  problem  trends. 

The  change  to  the  reporting  requirements  was 
signed  by  James  B.  Jackson.  Jr. .  for  Glynn  Lun- 
ney,  who  was  at  that  time  manager  of  the  Na- 
tional Space  Transportation  System  (Level  II 
manager).  The  change  was  submitted  by  Mar- 
tin Raines,  director  of  Safety.  Reliability  and 
Quality  Assurance  at  Johnson.9  With  this  action. 
Level  II  lost  all  insight  into  safety,  operational 
and  flight  schedule  issues  resulting  from  Level  III 
problems. 

On  May  19,  1986,  Mr.  Raines  wrote  a  memo 
in  which  he  explained  that  the  documentation 
change  was  made  in  an  attempt  to  streamline  the 
system  since  the  old  requirements  were  not  pro- 
ductive for  the  operational  phase  of  the  Shuttle 
program.10  In  retrospect,  it  is  still  difficult  to 
understand  why  the  director  of  Safety,  Reliability 
and  Quality  Assurance  at  Johnson  initiated  this 
action,  and  it  is  even  more  difficult  to  understand 
why  Level  II  approved  it. 

A  review  of  all  Level  III  monthly  problem 
reports  (Open  Problem  List)  issued  by  Marshall 
during  1984  and  1985  indicates  that  none  was 
distributed  to  Level  II  management.  From  a 
lengthy  list  of  recipients,  only  a  single  copy  was 
sent  to  Johnson,  and  that  one  was  sent  to  an 
engineer  in  the  flight  control  division.  Mr. 
Aldrich's  office  and  the  entire  Johnson  safety. 
reliability  and  quality  assurance  directorate  were 
not  on  the  distribution  list  for  the  problem 
reports.  A  Rockwell  International  safety,  reliabil- 
ity  and  quality  assurance  contractor  at  Johnson 
received  a  statistical  summary  of  problem  status. 
but  not  the  actual  problems  descriptions. 

Reporting  of  In-flight  Anomalies 

A  second  method  of  notifying  Level  II  of  prob- 
lems would  have  been  through  the  in-flight 
anomaly  reporting  channels.  The  identifier  tion 
and  resolution  of  anomalies  that  occur  during 


flight  are  addressed  in  Space  Shuttle  Program 
Directive  34E.  For  the  Solid  Rocket  Booster,  the 
Huntsville  Operations  Support  Center  is  charged 
with  these  activities  as  well  as  other  evaluations 
and  documentation  of  mission  results. 

"The  Space  Shuttle  Project  Managers  at 
Kennedy,  Johnson,  and  Marshall,  and  the 
Manager  for  Systems  Integration  are 
responsible  for  the  implementation  of  this 
directive  in  their  respective  areas."11 

A  letter  dated  October  20,  1981.  from  the 
manager  of  the  National  Space  Transportation 
System  (Level  II)  addressed  flight  anomaly 
resolution: 

"Beginning  with  the  STS-2  evaluations, 
the  enclosed  new  form  and  instructions, 
outlined  in  enclosure  1 .  will  be  utilized  for 
all  official  flight  anomaly  closeouts.  Flight 
anomalies  will  be  presented  for  review  and 
closeout  at  the  Noon  Special  PRCB  [Pro- 
gram Requirements  Change  Board].  The 
briefing  charts  will  be  prepared  by  the  Proj- 
ect elements,  and  should  include  a 
schematic/graph/sketch  of  the  problem  area. 
This  material,  along  with  the  closeout  form 
and  appropriate  signatures,  will  become  a 
part  of  the  permanent  closeout  record. 
Enclosure  2  provides  a  sample  of  closeout 
material  from  STS-1  that  would  be 
acceptable. 

"Your  cooperation  in  this  activity  will  be 
appreciated."12 

Since  O-ring  erosion  and  blow-by  were  con- 
sidered by  Marshall  to  be  flight  anomalies,13  the 
letter  above  would  appear  to  require  reporting 
by  the  Solid  Rocket  Booster  Project  Office  to 
Level  II.  However,  the  sample  closeout  material 
attached  to  the  1981  letter  was  identified  as  per- 
taining to  "Flight  Test"  (the  first  four  flights).  The 
1983  change  might  well  have  been  interpreted  as 
superseding  the  1981  Lunney  letter,  particular- 
ly since  the  program  officially  became  "opera- 
tional" in  late  1982. 

The  reporting  of  anomalies  (unexpected  events 
or  unexplained  departures  from  past  experience) 
that  occur  during  mission  performance  is  a  key 
ingredient  in  any  reliability  and  quality  assurance 
program.  Through  accurate  reporting,  careful 
analysis  and  thorough  testing,  problems  or  recur- 
rence of  problems  can  be  prevented.  In  an  effec- 
tive program,  reporting,  analysis,  testing  and  im- 
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plementation  of  corrective  measures  must  be  fully 
documented. 

The  level  of  management  that  should  be  in- 
formed is  a  function  of  the  seriousness  of  the  prob- 
lem. For  Criticality  1  equipment  anomalies,  the 
communications  must  reach  all  levels  of  manage- 
ment. Highly  detailed  and  specific  procedures  for 
reporting  anomalies  and  problems  are  essential 
to  the  entire  process.  The  procedures  must  be 
understood  and  followed  by  all. 

Unfortunately,  NASA  does  not  have  a  concise 
set  of  problem  reporting  requirements.  Those  in 
effect  are  found  in  numerous  individual 
documents,  and  there  is  little  agreement  about 
which  document  applies  to  a  given  level  of 
management  under  a  given  set  of  circumstances 
for  a  given  anomaly. 


Safety  Program  Failures 

The  safety,  reliability  and  quality  assurance 
program  at  Marshall  serves  a  dual  role.  It  is 
responsible  for  assuring  that  the  hardware 
delivered  for  use  on  the  Space  Shuttle  meets 
design  specifications.  In  addition,  it  acts  as  a 
"watch  dog"  on  the  system  to  assure  that  sound 
engineering  judgment  is  exercised  in  the  use  of 
hardware  and  in  appraising  hardware  problems. 
Limited  human  resources  and  an  organization 
that  placed  reliability  and  quality  assurance  func- 
tions under  the  director  of  Science  and  Engineer- 
ing reduced  the  capability  of  the  "watch  dog"  role. 

Much  of  what  follows  concerns  engineering 
judgments  and  decisions  by  engineers  and 
managers  at  Marshall  and  Morton  Thiokol.  It 
is  the  validity  of  these  judgments  that  the  Com- 
mission has  examined  closely.  In  its  "watch  dog" 
role,  an  effectively  functioning  safety,  reliability 
and  quality  assurance  organization  could  have 
taken  action  to  prevent  the  51-L  accident. 

In  the  discussion  that  follows,  various  aspects 
of  the  Solid  Rocket  Booster  joint  design  issue 
discussed  earlier  will  be  reviewed  in  the  context 
of  safety,  reliability  and  quality  assurance.  The 
critical  issue,  discussed  in  detail  elsewhere,  in- 
volves the  O-rings  installed  to  seal  the  booster 
joints. 

Trend  Data 

Development  of  trend  data  and  the  possible 
relationships  between  problems  is  a  standard  and 


expected  function  of  any  reliability  and  quality 
assurance  program.  As  previously  noted,  the 
history  of  problems  with  the  Solid  Rocket  Booster 
O-ring  took  an  abrupt  turn  in  January,  1984, 
when  an  ominous  trend  began.  Until  that  date, 
only  one  field  joint  O-ring  anomaly  had  been 
found  during  the  first  nine  flights  of  the  Shuttle. 
Beginning  with  the  tenth  mission,  however,  and 
concluding  with  the  twenty-fifth,  the  Challenger 
flight,  more  than  half  of  the  missions  experienced 
field  joint  O-ring  blow-by  or  erosion  of  some 
kind. 

In  retrospect,  this  trend  is  easily  recognizable. 
According  to  Wiley  Bunn,  director  of  Reliabil- 
ity and  Quality  Assurance  at  Marshall: 

"I  agree  with  you  from  my  purview  in 
quality,  but  we  had  that  data.  It  was  a  mat- 
ter of  assembling  that  data  and  looking  at 
it  in  the  proper  fashion.  Had  we  done  that, 
the  data  just  jumps  off  the  page  at  you."14 

This  striking  change  in  performance  should 
have  been  observed  and  perhaps  traced  to  a  root 
cause.  No  such  trend  analysis  was  conducted. 
While  flight  anomalies  involving  the  O-rings 
received  considerable  attention  at  Morton 
Thiokol  and  at  Marshall,  the  significance  of  the 
developing  trend  went  unnoticed.  The  safety, 
reliability  and  quality  assurance  program,  of 
course,  exists  to  ensure  that  such  trends  are 
recognized  when  they  occur. 

A  series  of  changes  to  Solid  Rocket  Booster 
processing  procedures  at  Kennedy  may  be  signifi- 
cant: on-site  O-ring  inspections  were  discon- 
tinued; O-ring  leak  check  stabilization  pressure 
on  the  field  joint  was  increased  to  200  pound  per 
square  inch  from  100,  sometimes  blowing  holes 
through  the  protective  putty;  the  patterns  for  posi- 
tioning the  putty  were  changed;  the  putty  type 
was  changed;  re-use  of  motor  segment  casings  in- 
creased; and  a  new  government  contractor  began 
management  of  Solid  Rocket  Booster  assembly. 
One  of  these  developments  or  a  combination  of 
them  was  probably  the  cause  of  the  higher 
anomaly  rate.  The  safety,  reliability  and  quality 
assurance  program  should  have  tracked  and 
discovered  the  reason  for  the  increasing  erosion 
and  blow-by. 

The  history  of  problems  in  the  nozzle  joint  is 
similar  to  that  of  the  Solid  Rocket  Booster  field 
joint.  While  several  of  the  changes  mentioned 
above  also  could  have  influenced  the  frequency 
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Pressure  tests  at  200  pounds  per  square  inch  of  the  Solid 
Rocket  Booster  joints  produced  bubbles  in  putty  used  to  line 
the  joints. 


of  nozzle  O-ring  problems,  the  frequency  cor- 
relates with  leak  check  pressure  to  a  remarkable 
degree. 

Again,  development  of  trend  data  is  a  standard 
and  expected  function  of  any  reliability  and  qual- 
ity assurance  program.  Even  the  most  cursory  ex- 
amination of  failure  rate  should  have  indicated 
that  a  serious  and  potentially  disastrous  situation 
was  developing  on  all  Solid  Rocket  Booster  joints. 
Not  recognizing  and  reporting  this  trend  can  only 
be  described,  in  NASA  terms,  as  a  "quality- 
escape, "  a  failure  of  the  program  to  preclude  an 
avoidable  problem.  If  the  program  had  func- 
tioned properly,  the  Challenger  accident  might 
have  been  avoided.  The  trend  should  have  been 
identified  and  analyzed  to  discover  the  physical 
processes  damaging  the  O-ring  and  thus  jeopard- 
izing the  integrity  of  the  joint. 

A  likely  cause  of  the  O-ring  erosion  appears 
to  have  been  the  increased  leak  check  pressure 
that  caused  hazardous  blow  holes  in  the  putty. 
Such  holes  at  booster  ignition  provide  a  ready- 
path  for  combustion  gases  directly  to  the  O-ring. 
The  blow  holes  were  known  to  be  created  by  the 
higher  pressure  used  in  the  leak  check.  The 
phenomenon  was  observed  and  even  photo- 
graphed prior  to  a  test  firing  in  Utah  on  May  9, 
1985.  In  that  particular  case,  the  grease  from  the 
O-ring  was  actually  blown  through  the  putty  and 
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was  visible  on  the  inside  core  of  the  Solid  Rocket 
Booster. 

The  trends  of  flight  anomalies  in  relation  to 
leak  check  stabilization  pressure  are  illustrated  for 
the  field  joint  and  the  nozzle  joint  in  Figure  3, 
on  page  133.  While  the  data  point  concerning  the 
100  pound  per  square  inch  field  joint  leak  check 
is  not  conclusive  since  it  is  based  on  only  two 
flights,  the  trend  is  apparent. 

Management  Awareness 

During  its  investigation,  the  Commission 
repeatedly  heard  witnesses  refer  to  redundancy 
in  the  Solid  Rocket  Motor  joint  and  argue  over 
the  criticality  of  the  joint.  While  the  field  joint 
has  been  categorized  as  a  Criticality  1  item  since 
1982  (page  157),  most  of  the  problem  reporting 
paperwork  generated  by  Thiokol  and  Marshall 
listed  it  as  Criticality  1R,  perhaps  leading  some 
managers  to  believe  — wrongly  — that  redundan- 
cy existed.  The  Problem  Assessment  System 
operated  by  Rockwell  contractors  at  Marshall. 
which  routinely  updates  the  problem  status  still 
listed  the  field  joint  as  Criticality  1R  on  March 
7,  1986,  more  than  five  weeks  after  the  accident. 
Such  misrepresentation  of  criticality  must  also  be 
categorized  as  a  failure  of  the  safety,  reliability 
and  quality  assurance  program.  As  a  result,  in- 
formed decision  making  by  key  managers  was 
impossible. 
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Awrcvtfl: 


Fi.'vt  Mca<4  Cjutu      Lea*age  at  case  assembly  joints  ou«   to  redundant  0-nng  seal   failures  or  primary  seal  and 
leak  check  port  0-rlng  failure. 

NOTE:     Leakage  of  the  primary  O-Mng  seal   1s  classified  as  a  single  failure  point  due  to  possibility  Of  loss  of 
staTlng  at  tne  secondary  0-nng  because  of  Joint  rotation  after  rotor  pressurlzadon. 


Fi.iurt  £fi*ct  Summary-     Actual  Loss  -Loss  of  mission.  veMcle..  and  crew  due  tomeul  erosion,  oumthrougn,  a/>o 
probable  case  burst  resulting  in  fir*  and  deflagration. 


RATIONALE  FOR  RETENTION 


Case,  P/N   1US0129,   1U50131,  1U5G120,   1U501E5 .   1US0147,   1US0715,  1U50716,  1US0717 
A.     DESIGN 

The  SRM  case  Joint  design  Is  cconon  1n  the  lightweight  and  regular  weight  cases  haying  Identical  d1m#n;1©ns. 
The  joint  concept  1s  basically  the  same  as  the  single  0«ring  joint  successfully  emoloyeu  on  the  Titan  III 
solid  rocket  motor.     The  S^M  joint  uses  centering  clips  which  are  Installed  in  the  gap  between  th«  tang  0.0. 
find  tne  outside  v.l*vla  leg  to  rr<rtnfns.a;e  *'or  the  loss  of  concentricity  due  to  gathering  and  to  reduce  tn* 
total   clevis   gao  wnich  has  been  provioed  for  ease  or   assewl*.     On  the  chuttli  SE1.  the  Secondary  O-Mng 
was  designed  to  provide  redundancy  and  to  permit  4  lean  check,  ensuring  prop?r  installation  of  tl»«  v-Hny». 
Full  redundancy  exists  at  the  mcrr.ent  of  initial  pressurization.     Hcwever,  test  data  shows  that  4  phenomenon 
called  joint  rotation  occurs  as  the  oressur?  rises,  ooenlnc  uo  the  0-nr.g  extrusion  gap  and  permitting  Shi 
energized  0-rlng  to  orotrude  ln:o  the  gap.     This  condition  has  been  snewn  py  test  to  be  well  wltnin.  that 
required  for  saf»  onmary  0-ring  sealing.     This  gap  may,  hcwever,  in  seme  cases,  increase  sufficiently  to 
cause  the  unenergueo  secondary  0-nng  to  lose  cocoression,  raising  Question  as  to  Its  ability  to  energize 
and  seal    1f  called  uoon  to  00  so  by  pri.r-ary  seal   failure.     Since,  unaer  this   latter  condition  only  the 
Jingle  0-r1ng  1s  sealing,  a  rationale  for  retention  is  provided  for  the  simplex  node  wnert  only  cue  0-Mna, 
1$  acting. 

The  Surface  finish  requirerent  for  the  0-Hr.g  grooves  is  63  and  the  finish  of  the  0-r1ng  contacting  portion 
of  the  tang,  which  slice's  acrcis  the  0-nng  during  Joint  asserroly,  is  32.     The  joint  design  provides  an  CO 
for  the  0-r1mj  Installation,  wnich  facilitates   retention  during  joint  asspnbly.     The   tare  has  a   Urge  Snallow 
angle  chamfer  on  tne  tip  to  prevent  tne  cutting  of  the  0-nng  at  assemoiy.     7h«»  design  orawine  teecifies 
application  of  0-nng  lubricant  prior  to  the  installation.     The  factory  assembled  Joints  have  ''BR  rubber 
material  vulcanized  across  tne   internal  joint  faying  surfaces  as  a  part  of  the  case  internal   1niulet10ft 
Subsystem. 

A  small  MS  port  leading  to  the  annular  cavity  between  the  redundant  seals  permits  a  leak  check  of  the  seals 
Immediately  after  joining  se^ents.     The  MS  plug,  Installed  after' leak  test,  has  a  retaining  groove  and 
compression  face  for  ms  0-nng  seal.     A  meant  to  test  the  seal  of  the  Installed  MS  plug  has  not  Ottn 
established. 

The  0-r1ngs   for  the  case  Joints  are  mold   formed  and  ground  to  close  tolerance  and  the  0-r1ngi  for  the   ttst 
port  art  mold  formed  to  net  dimensions.     Botn  0-r1ngs  ire  made  for  high   tcmnerature,   low  compression  set 
fluorocartjon  elastomer.     The  dtsign  permits  five  scarf  joints  for  the  case  joint  seal  rings.     ThO  0-r1no 
Joint  strength  must  equal  or  exceed  401  of  the  parent  material  strengtn. 

8.    TISTIKG 


eight  static  firings  and  five  flights  have  resulted  1n  ISO  (54  field  and  126  factory)  Joints 
ith'no  evidence  of  leakage.     The  Titan  III  program  using  a  similar  Joint  concept  has  tested  a  tot»l 


To  date, 

tested  w 

ef  1076  Joints  successfully. 
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ratory  test  program  demonstrated  tha  ability  of  the  0«ring  to  coerue  successfully  when  extruded 
mio  saps  well  over  those  encountered  1n  this  0-ring  application.     Uniform  gaps  of  1/8-inch  and  over  (TVR. 
13486)   successfully  withstood  pressures  of  16C0  ps1.     The  Hydrcburst  Program  {TWR-11664)  and  the  Structural 
Test  Program  (STA-1)   for  the  standard  weight  case  (TVa-l2C51)  and  the  Lightweight  Case  Joint  Certification 
Test  (TVR-12829)  all  have  shown  that  the  0-r1ng  can  withstand  a  minimum  of  four  pressurljatlons  before  damage 
to  the  ring  can  permit  any  leakage. 

Further  demonstration  of  the  capability  of  joint  sealing  !>  found  in  -.h.  hy«ro-PrW  etatlM  af  mw  and 
refurbished  case  segments.     Over  540  joints  have  been  exposed  to  liouid  pressurlmions  at  levels 
exceeding  motor  HEO?  witn  no  leakage  experienced  past  the  priory  i-rmg.     The  only  occasions  where  leakjoe 
was  experienced  was  during  refurbishment  of  5TS-1  wnere  two  stiffener  segments  were  severely  damaged  dun  no 
cavity  collapse  at  w4ter  Impact.  s 

A  more  detailed  description  of  5RH  Joint  testing  history  Is  contained  1n  TWR.13520.  Revision  A. 
C.     INSPECTION 

The  tang  -A-  diameter  and  clevis  -C-  diameter  are  measured  and  recorded.     The  depth,  width  and  surface 
finish  cf  the  0-rings  grooves  are  verified.     The  surface  finish  of  t!»e  tano  1s  also  verified.     Characteristics 
•re  Inspected  on  each  0-ring  to  assure  conformance  to  Uie  standarcs  to  Include: 

o  Surface  conditions 

0  Hold  flashing 

o  Scarf  Joint  mismatch  or  separation 

0  Cross  section 

o  Circumference 

o  Ourometer 

Each  assembled  Joint  seal  Is  tested  per  STV7-2747  via  pressurizing  the  annular  eavlty  between  seals  *o  SO 
5  psl  and  monitoring  for  10  minutes.  A  pressure  decay  of  1  pslo  cr  creator  1s  not  acceptable.  Following 
seal  verification  by  QC.  the  leak  test  port  plug  1s  installed. with  CC .verifying  Installation  and  torching. 

0.  FAILUR!  HIST0RT 


*o  fsiTurw  k,»v»  *••?:  experienced  1r.  t-k.c  static 
motors  and  ten  flight  motors. 


ing  cf  t»r«r  qualification  motors,  five  development 
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Mr.  Bunn,  the  director  of  Reliability  and 
Quality  Assurance  at  Marshall,  stated  on  April 
17.  1986: 

"But  the  other  thing  you  will  notice  on 
those  problem  reports  is  that  for  some  reason 
on  the  individual  problem  reports  we  kept 
sticking  [Criticality]  1-R  on  them  and  that 
is  just  a  sheer  quality  escape."15 

The  Impact  of  Misinformation 

The  manner  in  which  misinformation  in- 
fluences top  management  has  been  illustrated  by 
former  Associate  Administrator  for  Space  Flight 
Jesse  Moore. 

"And  then  we  had  a  Flight  Readiness 
Review,  I  guess,  in  July,  getting  ready  for 
a  mid-July  or  a  late  July  flight,  and  the  ac- 
tion had  come  back  from  the  project  office. 
I  guess  the  Level  III  had  reported  to  the 
Level  II  Flight  Readiness  Review,  and  then 
they  reported  up  to  me  that  — they  reported 
the  two  erosions  on  the  primary  (O-ring)  and 
some  10  or  12  percent  erosion  on  the  sec- 
ondary (O-ring)  on  that  flight  in  April,  and 
the  corrective  actions,  I  guess,  that  had  been 
put  in  place  was  to  increase  the  test  pressure, 
I  think,  from  50  psi  [pounds  per  square  inch] 
to  200  psi  or  100  psi  — I  guess  it  was  200  psi 
is  the  number  — and  they  felt  that  they  had 
run  a  bunch  of  laboratory  tests  and  analyses 
that  showed  that  by  increasing  the  pressure 
up  to  200  psi,  this  would  minimize  or 
eliminate  the  erosion,  and  that  there  would 
be  a  fairly  good  degree  of  safety  factor 
margin  on  the  erosion  as  a  result  of  increas- 
ing this  pressure  and  ensuring  that  the  sec- 
ondary seal  had  been  seated.  And  so  we  left 
that  FRR  [Flight  Readiness  Review]  with 
that  particular  action  closed  by  the  proj- 


ect. 
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Not  only  was  Mr.  Moore  misinformed  about 
the  effectiveness  and  potential  hazards  associated 
with  the  long-used  "new"  procedure,  he  also  was 
misinformed  about  the  issue  of  joint  redundan- 
cy. Apparently,  no  one  told  (or  reminded)  Mr. 
Moore  that  while  the  Solid  Rocket  Booster  noz- 
zle joint  was  Criticality  1R,  the  field  joint  was 
Criticality  1.  No  one  told  him  about  blow  holes 
in  the  putty,  probably  resulting  from  the  in- 
creased stabilization  pressure,  and  no  one  told 
him  that  this  "new"  procedure  had  been  in  use 


since  the  exact  time  that  field  joint  anomalies  had 
become  dangerously  frequent.  At  the  time  of  this 
briefing,  the  increased  pressure  already  had  been 
used  on  four  Solid  Rocket  Motor  nozzle  joints, 
and  all  four  had  erosion.  Erosion  was  the  enemy, 
and  increased  pressure  was  its  ally. 

While  Mr.  Moore  was  not  being  intentionally 
deceived,  he  was  obviously  misled.  The  report- 
ing system  simply  was  not  making  trends,  status 
and  problems  visible  with  sufficient  accuracy  and 
emphasis. 

Reporting  Launch  Constraints 

The  Commission  was  surprised  to  learn  that 
a  launch  constraint  had  been  imposed  on  the 
Solid  Rocket  Booster.  It  was  further  surprised  to 
learn  that  those  outside  of  Marshall  were  not 
notified.  Because  of  the  seriousness  of  the  mis- 
sion 51-B  nozzle  O-ring  erosion  incident,  launch 
constraints  were  placed  against  the  next  six  Shut- 
tle flights.  A  launch  constraint  arises  from  a  flight 
safety  issue  of  sufficient  seriousness  to  justify  a 
decision  not  to  launch.  The  initial  problem 
description  stated  that,  "based  on  the  amount  of 
charring,  the  erosion  paths  on  the  primary  O-ring 
and  what  is  understood  about  the  erosion 
phenomenon,  it  is  believed  that  the  primary  O- 
ring  of  SRM  16A  [the  Solid  Rocket  Motor  on 
flight  51-B]  never  seated."17  The  maximum  ero- 
sion depth  was  0.171  inches  on  the  primary  O- 
ring  and  0.032  inches  on  the  secondary.  On 
February  12,  at  a  Level  III  Flight  Readiness 
Review,  maximum  expected  erosion  on  nozzle 
joint  O-rings  had  been  projected  as  0.070  inches 
for  the  primary  and  0.004  inches  for  the  second- 
ary. Thus,  the  results  far  exceeded  the  max- 
imum expected.  If  this  same  ratio  of  actual  to  pro- 
jected erosion  were  to  occur  on  a  field  joint,  the 
erosion  would  be  0.225  inches.  With  secondary- 
seal  inadequacy,  as  indicated  by  Criticality  1 
status,  that  degree  of  erosion  could  result  in  joint 
failure  and  loss  of  vehicle  and  crew. 

The  Problem  Reporting  and  Corrective  Action 
document  (JSC  08126A,  paragraph  3. 2d)  re- 
quires project  offices  to  inform  Level  II  of  launch 
constraints.  That  requirement  was  not  met. 
Neither  Level  II  nor  Level  I  was  informed. 

Implications  of  an  Operational  Program 

Following  successful  completion  of  the  orbital 
flight  test  phase  of  the  Shuttle  program,  the 
system  was  declared  to  be  operational.  Subse- 
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quently,  several  safety,  reliability  and  quality 
assurance  organizations  found  themselves  with 
reduced  and/or  reorganized  functional  capabil- 
ity. Included,  notably,  were  the  Marshall  offices 
where  there  was  net  attrition18  and  NASA  Head- 
quarters where  there  were  several  reorganizations 
and  transfers. 

The  apparent  reason  for  such  actions  was  a 
perception  that  less  safety,  reliability  and  quali- 
ty assurance  activity  would  be  required  during 
"routine"  Shuttle  operations.  This  reasoning  was 
faulty.  The  machinery  is  highly  complex,  and  the 
requirements  are  exacting.  The  Space  Shuttle  re- 
mains a  totally  new  system  with  little  or  no 
history.  As  the  system  matures  and  the  experience 
changes,  careful  tracking  will  be  required  to  pre- 
vent premature  failures.  As  the  flight  rate  in- 
creased, more  hardware  operations  were  in- 
volved, and  more  total  in-flight  anomalies 
occurred. 19  Tracking  requirements  became  more 
rather  than  less  critical  because  of  implications 
for  the  next  flight  in  an  accelerating  program. 

Two  problems  on  mission  61-C  were  not 
evaluated  as  part  of  the  review  process  for  the  next 
flight,  51-L.  A  serious  failure  of  the  Orbiter  wheel 
brake  was  not  known  to  the  crew  as  mission  51-L 
lifted  off  with  a  plan  to  make  the  first  Kennedy 
landing  since  a  similar  problem  halted  such 
operations  in  April,  1985. 20  Secondly,  an  O-ring 
erosion  problem  had  occurred  on  mission  61-C, 
and  while  it  had  been  discovered,  it  had  not  been 
incorporated  into  the  Problem  Assessment 
System  when  mission  51-L  was  launched.21  If  the 
program  cannot  come  to  grips  with  such  critical 
safety  aspects  before  subsequent  flights  are 
scheduled  to  occur,  it  obviously  is  moving  too 
fast,  or  its  safety,  reliability  and  quality  assurance 
programs  must  be  strengthened  to  provide  more 
rapid  response. 

The  inherent  risk  of  the  Space  Shuttle  program 
is  defined  by  the  combination  of  a  highly  dynamic 
environment,  enormous  energies,  mechanical 
complexities,  time  consuming  preparations  and 
extremely  time-critical  decision  making.  Com- 
placency and  failures  in  supervision  and  report- 
ing seriously  aggravate  these  risks. 

Rather  than  weaken  safety,  reliability  and 
quality  assurance  programs  through  attrition  and 
reorganization,  NASA  must  elevate  and 
strengthen  these  vital  functions.  In  addition, 
NASA's  traditional  safety,  reliability  and  quali- 
ty assurance  efforts  need  to  be  augmented  by  an 


alert  and  vigorous  organization  that  oversees  the 
flight  safety  program. 


Aerospace  Safety  Advisory  Panel 

The  Aerospace  Safety  Advisory  Panel  (the 
"panel"  in  what  follows)  was  established  in  the 
aftermath  of  the  Apollo  spacecraft  fire  January 
27,  1967.  Shortly  thereafter  the  United  States 
Congress  enacted  legislation  (Section  6  of  the 
NASA  Authorization  Act,  1968;  42  U.S.C.  2477) 
to  establish  the  panel  as  a  senior  advisory  com- 
mittee to  NASA.  The  statutory  duties  of  the  panel 
are: 

"The  panel  shall  review  safety  studies  and 
operations  plans  referred  to  it  and  shall  make 
reports  thereon,  shall  advise  the  Ad- 
ministrator with  respect  to  the  hazards  of 
proposed  operations  and  with  respect  to  the 
adequacy  of  proposed  or  existing  safety 
standards,  and  shall  perform  such  other 
duties  as  the  Administrator  may  request." 

The  panel  membership  is  set  by  statute  at  no 
more  than  nine  members,  of  whom  up  to  four 
may  come  from  NASA.  The  NASA  Chief  Engi- 
neer is  an  ex-officio  member.  The  staff  consists 
of  full-time  NASA  employees,  and  the  staff  direc- 
tor serves  as  both  executive  secretary  and 
technical  assistant  to  the  panel. 

The  role  of  the  panel  has  been  defined  and 
redefined  by  the  members  themselves,  NASA 
senior  management  and  members  of  the  House 
and  Senate  of  the  U.S.  Congress.  The  panel 
began  to  review  the  Space  Shuttle  program  in 
1971,  and  in  its  1974  annual  report,  it 
documented  a  shift  in  focus: 

"The  panel  feels  that  [a]  broader  examina- 
tion of  the  programs  and  their  management 
gives  them  more  confidence  than  in  limiting 
their  inquiry  to  safety  alone."22 

Over  ensuing  years,  the  panel  continued  to  ex- 
amine the  Space  Shuttle  program  including  safe- 
ty, reliability  and  quality  assurance;  systems 
redundancy;  flight  controls;  and  ground  process- 
ing and  handling,  though  management  issues 
continued  to  dominate  their  concerns.  Following 
the  first  flight  of  the  Shuttle,  the  panel  in- 
vestigated a  wide  variety  of  specific  subjects,  to 
include  the  lightweight  External  Tank,  the  Cen- 
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taur  and  Inertial  Upper  Stage  programs,  Shut- 
tle logistics  and  spare  parts,  landing  gear,  tires, 
brakes,  Solid  Rocket  Motor  nozzles  and  the  Solid 
Rocket  Motor  using  the  filament-wound  case. 
There  is  no  indication,  however,  that  the  details 
of  Solid  Rocket  Booster  joint  design  or  in-flight 
problems  were  ever  the  subject  of  a  panel  activi- 
ty. The  efforts  of  this  panel  were  not  sufficiently 
specific  and  immediate  to  prevent  the  51-L 
accident. 


Space  Shuttle  Program  Crew 
Safety  Panel 

The  Space  Shuttle  Crew  Safety  Panel, 
established  by  Space  Shuttle  Program  Directive 
4A  dated  April  17,  1974,  served  an  important 
function  in  NASA  flight  safety  activities,  until  it 
went  out  of  existence  in  1981.  If  it  were  still  in 
existence,  it  might  have  identified  the  kinds  of 
problems  now  associated  with  the  51-L  mission. 
The  purpose  of  the  panel  was  twofold:  (1)  to  iden- 
tify possible  hazards  to  Shuttle  crews  and  (2)  to 
provide  guidance  and  advice  to  Shuttle  program 
management  concerning  the  resolution  of  such 
conditions. 

The  membership  of  the  panel  comprised  10 
representatives  from  Johnson  and  a  single 
representative  each  from  Dryden  (the  NASA 
facility  at  Edwards  Air  Force  Base,  California), 
Kennedy,  Marshall  and  the  Air  Force. 

The  panel  was  to  support  the  Level  II  Program 
Requirements  Control  Board  chaired  by  the  proj- 
ect manager,  and  recommendations  were  subject 
to  Control  Board  approval. 

From  1974  through  1978.  the  panel  met  on  a 
regular  basis  (24  times)  and  considered  vital  issues 
ranging  from  mission  abort  contingencies  to 
equipment  acceptability.  The  membership  of  the 
panel  from  engineering,  project  management  and 
astronaut  offices  ensured  a  minimum  level  of  safe- 
ty communications  among  those  organizations. 
This  ceased  to  exist  when  the  panel  effectively 
ceased  to  exist  in  1980.23  NASA  had  expected  the 
panel  to  be  functional  only  "during  the  design, 
development  and  flight  test  phases"  and  to  "con- 
cern itself  with  all  vehicle  systems  and  operating 
modes."24  When  the  original  chairman,  Scott  H. 
Simpkinson,  retired  in  1981,  the  panel  was 
merged  with  a  safety  subpanel  that  assumed 
neither  the  membership  nor  the  functions  of  the 


safety  panel.  After  that  time,  the  NASA  Shuttle 
program  had  no  focal  point  for  flight  safety. 

The  Need  for  a  New  Safety 
Organization 

The  Aerospace  Safety  Advisory  Panel  unques- 
tionably has  provided  NASA  a  valuable  service, 
which  has  contributed  to  the  safety  of  NASA's 
operations.  Because  of  its  breadth  of  activities, 
however,  it  cannot  be  expected  to  uncover  all  of 
the  potential  problems  nor  can  it  be  charged  with 
failure  when  accidents  occur  that  in  hindsight 
were  clearly  probable.  The  ability  of  any  panel 
to  function  effectively  depends  on  a  focused  scope 
of  responsibilities.  An  acceptable  level  of  opera- 
tional safety  coverage  requires  the  total  combina- 
tion of  NASA  and  contractor  organizations, 
working  more  effectively  on  a  coordinated  basis 
at  all  levels.  The  Commission  believes,  therefore, 
that  a  top-to-bottom  emphasis  on  safety  can  best 
be  achieved  by  a  combination  of  a  strong  central 
authority  and  a  working  level  panel  devoted  to 
the  operational  aspects  of  Shuttle  flight  safety. 

Findings 

1 .  Reductions  in  the  safety,  reliability  and 
quality  assurance  work  force  at  Marshall 
and  NASA  Headquarters  have  serious- 
ly limited  capability  in  those  vital 
functions. 

2.  Organizational  structures  at  Kennedy 
and  Marshall  have  placed  safety, 
reliability  and  quality  assurance  offices 
under  the  supervision  of  the  very 
organizations  and  activities  whose  efforts 
they  are  to  check. 

3.  Problem  reporting  requirements  are  not 
concise  and  fail  to  get  critical  informa- 
tion to  the  proper  levels  of  management. 

4.  Little  or  no  trend  analysis  was  performed 
on  O-ring  erosion  and  blow-by  problems. 

5.  As  the  flight  rate  increased,  the  Marshall 
safety,  reliability  and  quality  assurance 
work  force  was  decreasing,  which 
adversely  affected  mission  safety. 

6.  Five  weeks  after  the  51-L  accident,  the 
criticality  of  the  Solid  Rocket  Motor  field 
joint  was  still  not  properly  documented 
in  the  problem  reporting  system  at 
Marshall.  ■ 
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Chapter  VI II 


Pressures  on 
the  System 


With  the  1982  completion  of  the  or- 
bital flight  test  series,  NASA 
began  a  planned  acceleration  of 
the  Space  Shuttle  launch  sched- 
ule. One  early  plan  contemplated  an  eventual  rate 
of  a  mission  a  week,  but  realism  forced  several 
downward  revisions.  In  1985,  NASA  published 
a  projection  calling  for  an  annual  rate  of  24  flights 
by  1990.  Long  before  the  Challenger  accident, 
however,  it  was  becoming  obvious  that  even  the 
modified  goal  of  two  flights  a  month  was 
overambitious. 

In  establishing  the  schedule,  NASA  had  not 
provided  adequate  resources  for  its  attainment. 
As  a  result,  the  capabilities  of  the  system  were 
strained  by  the  modest  nine-mission  rate  of  1985, 
and  the  evidence  suggests  that  NASA  would  not 
have  been  able  to  accomplish  the  15  flights 
scheduled  for  1986.  These  are  the  major  conclu- 
sions of  a  Commission  examination  of  the 
pressures  and  problems  attendant  upon  the  ac- 
celerated launch  schedule. 

On  the  same  day  that  the  initial  orbital  tests 
concluded— July  4,  1982  — President  Reagan  an- 
nounced a  national  policy  to  set  the  direction  of 
the  U.S.  space  program  during  the  following 
decade.  As  part  of  that  policy,  the  President  stated 
that: 

"The  United  States  Space  Transportation 
System  (STS)  is  the  primary  space  launch 
S)  stem  for  both  national  security  and  civil 
government  missions." 

Additionally,  he  said: 

"The  first  priority  of  the  STS  program  is 
to  make  the  system  fully  operational  and 


cost-effective  in  providing  routine  access  to 
space." 

From  the  inception  of  the  Shuttle,  NASA  had 
been  advertising  a  vehicle  that  would  make  space 
operations  "routine  and  economical."  The  greater 
the  annual  number  of  flights,  the  greater  the 
degree  of  routinization  and  economy,  so  heavy 
emphasis  was  placed  on  the  schedule.  However, 
the  attempt  to  build  up  to  24  missions  a  year 
brought  a  number  of  difficulties,  among  them  the 
compression  of  training  schedules,  the  lack  of 
spare  parts,  and  the  focusing  of  resources  on  near- 
term  problems. 

One  effect  of  NASA's  accelerated  flight  rate  and 
the  agency's  determination  to  meet  it  was  the  dilu- 
tion of  the  human  and  material  resources  that 
could  be  applied  to  any  particular  flight. 

The  part  of  the  system  responsible  for  turning 
the  mission  requirements  and  objectives  into 
llight  software,  flight  trajectory  information  and 
crew  training  materials  was  struggling  to  keep  up 
with  the  flight  rate  in  late  1985,  and  forecasts 
showed  it  would  be  unable  to  meet  its  milestones 
for  1986.  It  was  falling  behind  because  its 
resources  were  strained  to  the  limit,  strained  by 
the  flight  rate  itself  and  by  the  constant  changes 
it  was  forced  to  respond  to  within  that  accelerating 
schedule.  Compounding  the  problem  was  the  fact 
that  NASA  had  difficulty  evolving  from  its  single- 
flight  focus  to  a  system  that  could  efficiently  sup- 
port the  projected  flight  rate.  It  was  slow  in 
developing  a  hardware  maintenance  plan  for  its 
reusable  fleet  and  slow  in  developing  the 
capabilities  that  would  allow  it  to  handle  the 
higher  volume  of  work  and  training  associated 
with  the  increased  flight  frequency. 
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Pressures  developed  because  of  the  need  to 
meet  customer  commitments,  which  translated 
into  a  requirement  to  launch  a  certain  number 
of  flights  per  year  and  to  launch  them  on  time. 
Such  considerations  may  occasionally  have 
obscured  engineering  concerns.  Managers  may 
have  forgotten  — partly  because  of  past  success, 
partly  because  of  their  own  well-nurtured  image 
of  the  program  — that  the  Shuttle  was  still  in  a 
research  and  development  phase.  In  his  testimony 
before  a  U.S.  Senate  Appropriations  subcommit- 
tee on  May  5,  1982,  following  the  third  flight  of 
the  Space  Shuttle,  James  Beggs,  then  the  NASA 
Administrator,  expressed  NASA's  commitment: 

"The  highest  priority  we  have  set  for 
NASA  is  to  complete  development  of  the 
Shuttle  and  turn  it  into  an  operational 
system.  Safety  and  reliability  of  flight  and 
the  control  of  operational  costs  are  primary 
objectives  as  we  move  forward  with  the  Shut- 
tle program."1 

Sixteen  months  later,  arguing  in  support  of  the 
Space  Station,  Mr.  Beggs  said,  "We  can  start 
anytime.  .  .  .  There's  no  compelling  reason  [why] 
it  has  to  be  1985  rather  than  '86  or  '87.  The  point 
that  we  have  made  is  that  the  Shuttle  is  now 
operational."2  The  prevalent  attitude  in  the  pro- 
gram appeared  to  be  that  the  Shuttle  should  be 
ready  to  emerge  from  the  developmental  stage, 
and  managers  were  determined  to  prove  it 
"operational." 

Various  aspects  of  the  mission  design  and 
development  process  were  directly  affected  by  that 
determination.  The  sections  that  follow  will 
discuss  the  pressures  exerted  on  the  system  by  the 
flight  rate,  the  reluctance  to  relax  the  optimistic 
schedule,  and  the  attempt  to  assume  an  opera- 
tional status. 

Planning  of  a  Mission 

The  planning  and  preparation  for  a  Space 
Shuttle  flight  require  close  coordination  among 
those  making  the  flight  manifest,  those  design- 
ing the  flight  and  the  customers  contracting 
NASA's  services.  The  goals  are  to  establish  the 
manifest;  define  the  objectives,  constraints  and 
capabilities  of  the  mission;  and  translate  those  into 
hardware,  software  and  flight  procedures. 

There  are  major  program  decision  points  in  the 
development  of  every  Shuttle  flight.  At  each  of 


these  points,  sometimes  called  freeze  points,  deci- 
sions are  made  that  form  the  basis  for  further 
engineering  and  product  development.  The 
disciplines  affected  by  these  freeze  points  include 
integration  hardware,  engineering,  crew  timeline, 
flight  design  and  crew  training. 

The  first  major  freeze  point  is  at  launch  minus 
15  months.  At  that  time  the  flight  is  officially 
defined:  the  launch  date,  Orbiter  and  major 
payloads  are  all  specified,  and  initial  design  and 
engineering  are  begun  based  on  this  information. 

The  second  major  freeze  point  is  at  launch 
minus  7.7  months,  the  cargo  integration  review. 
During  this  review,  the  integration  hardware 
design.  Orbiter  vehicle  configuration,  flight 
design  and  software  requirements  are  agreed  to 
and  specified.  Further  design  and  engineering  can 
then  proceed. 

Another  major  freeze  point  is  the  flight  plan- 
ning and  stowage  review  at  launch  minus  five 
months.  At  that  time,  the  crew  activity  timeline 
and  the  crew  compartment  configuration,  which 
includes  middeck  payloads  and  payload  specialist 
assignments,  are  established.  Final  design, 
engineering  and  training  are  based  on  these 
products. 

Development  of  Flight  Products 

The  "production  process"  begins  by  collecting 
all  mission  objectives,  requirements  and  con- 
straints specified  by  the  payload  and  Space  Shut- 
tle communities  at  the  milestones  described 
above.  That  information  is  interpreted  and 
assimilated  as  various  groups  generate  products 
required  for  a  Space  Shuttle  flight:  trajectory 
data,  consumables  requirements,  Orbiter  flight 
software,  Mission  Control  Center  software  and 
the  crew  activity  plan,  to  name  just  a  few. 

Some  of  these  activities  can  be  done  in  parallel, 
but  many  are  serial.  Once  a  particular  process 
has  started,  if  a  substantial  change  is  made  to  the 
flight,  not  only  does  that  process  have  to  be 
started  again,  but  the  process  that  preceded  it  and 
supplied  its  data  may  also  need  to  be  repeated. 
If  one  group  fails  to  meet  its  due  date,  the  group 
that  is  next  in  the  chain  will  start  late.  The  delay 
then  cascades  through  the  system. 

Were  the  elements  of  the  system  meeting  their 
schedules?  Although  each  group  believed  it  had 
an  adequate  amount  of  time  allotted  to  perform 
its  function,  the  system  as  a  whole  was  falling 
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Shuttle  Mission  Simulator  Training 


When  Shuttle  Mission  Simulator  Training  Began  in 
Comparison  With  the  Normal  Launch-minus-77-Days 
Training  Start  Date 
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Graph  depicts  beginning  of  simulator  training  for  Shuttle 
crews  in  days  before  launch  for  missions  41-B  through  61-E. 


behind.  An  assessment  of  the  system's  overall  per- 
formance is  best  made  by  studying  the  process 
at  the  end  of  the  production  chain:  crew  train- 
ing. Analysis  of  training  schedules  for  previous 
flights  and  projected  training  schedules  for  flights 
in  the  spring  and  summer  of  1986  reveals  a  clear 
trend:  less  and  less  time  was  going  to  be  available 
for  crew  members  to  accomplish  their  required 
training.  (See  the  Shuttle  mission  simulator  train- 
ins;  chart.) 

The  production  system  was  disrupted  by 
several  factors  including  increased  flight  rate,  lack 
of  efficient  production  processing  and  manifest 
changes. 


Changes  in  the  Manifest 

Each  process  in  the  production  cycle  is  based 
on  information  agreed  upon  at  one  of  the  freeze 
points.  If  that  information  is  later  changed,  the 
process  may  have  to  be  repeated.  The  change 
could  be  a  change  in  manifest  or  a  change  to  the 
Orbiter  hardware  or  software.  The  hardware  and 
software  changes  in  1985  usually  were  mandatory 
changes;  perhaps  some  of  the  manifest  changes 
were  not. 

The  changes  in  the  manifest  were  caused  by 
factors  that  fall  into  four  general  categories:  hard- 
ware problems,  customer  requests,  operational 
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constraints  and  external  factors.  The  significant 
changes  made  in  1985  are  shown  in  the  accom- 
panying table.  The  following  examples  illustrate 
that  a  single  proposed  change  can  have  extensive 
impact,  not  because  the  change  itself  is  particular- 
ly difficult  to  accommodate  (though  it  may  be), 
but  because  each  change  necessitates  four  or  five 
other  changes.  The  cumulative  effect  can  be 
substantial.  (See  the  Impact  of  Manifest  Changes 
chart.) 

When  a  change  occurs,  the  program  must 
choose  a  response  and  accept  the  consequences 
of  that  response.  The  options  are  usually  either 
to  maximize  the  benefit  to  the  customer  or  to 
minimize  the  adverse  impact  on  Space  Shuttle 
operations.  If  the  first  option  is  selected,  the  con- 
sequences will  include  short-term  and/or  long- 
term  effects. 

Hardware  problems  can  cause  extensive 
changes  in  the  payload  manifest.  The  51-E  mis- 
sion was  on  the  launch  pad,  only  days  from 
launch,  with  a  Tracking  and  Data  Relay  Satellite 
and  Telesat  satellite  in  the  cargo  bay,  when  a 
hardware  problem  in  the  tracking  satellite  was 
discovered.  That  flight  was  canceled  and  the 
payload  reassigned.  The  cancellation  resulted  in 
major  changes  to  several  succeeding  flights.  Mis- 
sion 51-D,  scheduled  to  fly  two  months  later,  was 
changed  to  add  the  Telesat  and  delete  the  retrieval 
of  the  Long  Duration  Exposure  Facility.  The 
retrieval  mission  was  then  added  to  mission  61-1, 
replacing  another  satellite.  A  new  mission  (61 -M) 
was  scheduled  for  July,  1986,  to  accommodate 
the  Tracking  and  Data  Relay  Satellite  and  the 
displaced  satellite,  and  all  flights  scheduled  later 
in  1986  slipped  to  make  room  for  61-M. 

Customers  occasionally  have  notified  NASA 
Headquarters  of  a  desire  to  change  their  sched- 
uled launch  date  because  of  development  prob- 
lems, financial  difficulties  or  changing  market 
conditions.  NASA  generally  accedes  to  these  re- 
quests and  has  never  imposed  the  penalties 
available.  An  example  is  the  request  made  to 
delay  the  flight  of  the  Westar  satellite  from  mis- 
sion 61-C  (December,  1985)  to  a  flight  in  March, 
1986.  Westar  was  added  to  flight  61-E,  and  the 
Getaway  Special  bridge  assembly  was  removed 
to  make  room  for  it;  the  HS-376  satellite  slot  was 
deleted  from  51-L  and  added  to  61-C;  the 
Spartan-Halley  satellite  was  deleted  from  61-D 
and  added  to  51-L.  Thus,  four  flights  experienced 
major  payload  changes  as  a  result  of  one 
customer's  request. 


1985  Changes  in  the  Manifest 

Hardware  Problems 

Tracking  and  Data  Relay  Satellite  (canceled 
51-E,  added  61-M). 

Synchronous  Communication  Satellite  (added 
to  61-C). 

Synchronous  Communication  Satellite  (re- 
moved from  61-C). 

OV-102  late  delivery  from  Palmdale 
(changed  to  51-G,  51-1,  and  61-A). 

Customer  Requests 

HS-376  (removed  from  51-1). 
G-Star  (removed  from  61-C). 
Satellite    Television    Corporation  — Direct 
Broadcast  Satellite  (removed  from  61-E). 

Westar  (removed  from  61-C). 

Satellite  Television  Corporation —  Direct 
Broadcast  Satellite  (removed  from  61-H). 

Electrophoresis  Operations  in  Space  (removed 
from  61 -B). 

Electrophoresis  Operations  in  Space  (removed 
from  61-H). 

Hubble  Space  Telescope  (swap  with  Earth 
Observation  Mission). 

Operational  Constraints 

No  launch  window  for  Skynet/Indian  Satellite 
Combination  (61-H). 

Unacceptable  structural  loads  for  Tracking  and 
Data  Relay  Satellite/Indian  Satellite  (61-H). 

Landing  weight  above  allowable  limits  for  each 
of  the  following  missions:  61-A,  61-E,  71-A, 
61-K. 

External  Factors 

Late  addition  of  Senator  Jake  Garn  (R-Utah) 
(51-D). 

Late  addition  of  Representative  Bill  Nelson  (D- 
Florida)  (61-C). 

Late  addition  of  Physical  Vapor  Transport 
Organic  Solid  experiment  (51-1). 
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Impact  of  Manifest  Changes 

on  Workload  at  Johnson  Space  Center 


140 


120 


100 


«      80 

go 

X3  UJ 

<  S-  60 


40 


20 


Mission 

^fl 

Redefined 

At  L-5  Review 

^               r 

At  Cargo  Integration  Review  (CIR) 

■                  B^^           Configuration 

*~ 

At  Cargo  Integration 
Review  Dry  Run  (CIRD) 

^^^       Mission 

^^^          Operations 

- 

■ — """"               Systems  Engineering 

Cargo  Engineering 



L- 

n 

15 

I  |  I   II  |  I  I   I  |   I  I  I  |  I 
L-1 4       L-13       L-12       L-1 1 

I    |    I    I    I    |    I    I    I    |    I 
L-10        L-9         L-8 

I   |   I   I    I  ||  I   I   I       I  1  I   |  I  I  1  |  I  I  1  |  I  I  I   |  1  1  I  | 

L-7         L-6         L-5         L-4          L-3          L-2          L-1           L-C 
I 

CIRD 


CIR  Installation  Launch  Minus  Months 

Instructions 
at  Kennedy 


Graph  shows  that  changes  to  the  payload  manifest  for  Shuttle 
missions  can  boost  Johnson  Space  Center  workload  as  much 
as  130  percent 


Operational  constraints  (for  example,  a  con- 
straint on  the  total  cargo  weight)  are  imposed  to 
insure  that  the  combination  of  payloads  does  not 
exceed  the  Orbiter's  capabilities.  An  example  in- 
volving the  Earth  Observation  Mission  Spacelab 
tlight  is  presented  in  the  NASA  Mission  Planning 
and  Operations  Team  Report  in  Appendix  J. 
That  case  illustrates  that  changes  resulting  from 
a  single  instance  of  a  weight  constraint  violation 
can  cascade  through  the  entire  schedule. 

Externa]  factors  have  been  the  cause  of  a 
number  of  changes  in  the  manifest  as  well.  The 
changes  discussed  above  involve  major  payloads, 


but  changes  to  other  payloads  or  to  payload 
specialists  can  create  problems  as  well.  One  small 
change  does  not  come  alone;  it  generates  several 
others.  A  payload  specialist  was  added  to  mission 
61-C  only  two  months  before  its  scheduled  lift  off. 
Because  there  were  already  seven  crew  members 
assigned  to  the  flight,  one  had  to  be  removed.  The 
Hughes  payload  specialist  was  moved  from  61-C 
to  51-L  just  three  months  before  51-L  was 
scheduled  to  launch.  His  experiments  were  also 
added  to  51-L.  Two  middeck  experiments  were 
deleted  from  51-L  as  a  result,  and  the  deleted  ex- 
periments would  have  reappeared  on  later  flights. 
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Simulation  Training 


When  Shuttle  Simulator  Training  Began  in  Comparison  with 
the  Normal  Launch-Minus-77-Days  Training  Start  Date 
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Graph  depicts  beginning  of  simulator  training  for  Shuttle  crews 
in  days  before  launch  for  missions  51 -L  through  61-K.  Launch 
minus  11  days  is  normal  training  date  start. 


Again,  a  "single"  late  change  affected  at  least  two 
flights  very  late  in  the  planning  and  preparation 
cycles. 

The  effects  of  such  changes  in  terms  of  budget, 
cost  and  manpower  can  be  significant.  In  some 
cases,  the  allocation  of  additional  resources  allows 
the  change  to  be  accommodated  with  little  or  no 
impact  to  the  overall  schedule.  In  those  cases, 
steps  that  need  to  be  re-done  can  still  be  ac- 
complished before  their  deadlines.  The  amount 
of  additional  resources  required  depends,  of 
course,  on  the  magnitude  of  the  change  and  when 
the  change  occurs:  early  changes,  those  before  the 


cargo  integration  review,  have  only  a  minimal 
impact;  changes  at  launch  minus  five  months  (two 
months  after  the  cargo  integration  review)  can 
carry  a  major  impact,  increasing  the  required 
resources  by  approximately  30  percent.  In  the 
missions  from  41-C  to  51-L,  only  60  percent  of 
the  major  changes  occurred  before  the  cargo  in- 
tegration review.  More  than  20  percent  occurred 
after  launch  minus  five  months  and  caused 
disruptive  budget  and  manpower  impacts.3 

Engineering  flight  products  are  generated 
under  a  contract  that  allows  for  increased  ex- 
penditures to  meet  occasional  high  workloads. 
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Even  with  this  built-in  flexibility,  however,  the 

requested  changes  occasionally  saturate  facilities 
and  personnel  capabilities.  The  strain  on  re- 
sources can  be  tremendous.  For  short  periods  of 
two  to  three  months  in  mid-1985  and  early  1986, 
facilities  and  personnel  were  being  required  to 
perform  at  roughly  twice  the  budgeted  flight  rate. 

If  a  change  occurs  late  enough,  it  will  have  an 
impact  on  the  serial  processes.  In  these  cases,  ad- 
ditional resources  will  not  alleviate  the  problem, 
and  the  effect  of  the  change  is  absorbed  by  all 
downstream  processes,  and  ultimately  by  the  last 
element  in  the  chain.  In  the  case  of  the  flight 
design  and  software  reconfiguration  process,  that 
last  element  is  crew  training.  In  January.  1986, 
the  forecasts  indicated  that  crews  on  flights  after 
51-L  would  have  significantly  less  time  than 
desired  to  train  for  their  flights.4  (See  the  Simula- 
tion Training  chart.) 

According  to  Astronaut  Henry  Hartsfield: 

"Had  we  not  had  the  accident,  we  were 
going  to  be  up  against  a  wall;  STS  61-H 
.  .  .  would  have  had  to  average  31  hours  in 
the  simulator  to  accomplish  their  required 
training,  and  STS  61-K  would  have  to 
average  33  hours.  That  is  ridiculous.  For  the 
first  time,  somebody  was  going  to  have  to 
stand  up  and  say  we  have  got  to  slip  the 
launch  because  we  are  not  going  to  have  the 
crew  trained."3 


"Operational"  Capabilities 

For  a  long  time  during  Shuttle  development, 
the  program  focused  on  a  single  flight,  the  first 
Space  Shuttle  mission.  When  the  program  be- 
came "operational,"  flights  came  more  frequent- 
ly, and  the  same  resources  that  had  been  applied 
to  one  flight  had  to  be  applied  to  several  flights 
(  oncurrently.  Accomplishing  the  more  pressing 
immediate  requirements  diverted  attention  from 
what  was  happening  to  the  system  as  a  whole. 
Thai  appears  to  be  one  of  the  many  telling  dif- 
ferences between  a  "research  and  development" 
program  and  an  "operational  program."  Some  of 
the  differences  are  philosophical,  some  are  at- 
titudinal  and  some  are  practical. 

Elements  within  the  Shuttle  program  tried  to 
adapt  their  philosophy,  then  attitude  and  their 
requirements  to  the  "operational  era."  But  that 
era  came  suddenly,  and  in  some  c  ases,  there-  h  id 


not  been  enough  preparation  for  what  "opera- 
tional" might  entail.  For  example,  routine  and 
regular  post-flight  maintenance  and  inspections 
are  critical  in  an  operational  program:  spare  parts 
are  critical  to  flight  readiness  in  an  operational 
fleet;  and  the  software  tools  and  training  facilities 
developed  during  a  test  program  may  not  be 
suitable  for  the  high  volume  of  work  required  in 
an  operational  environment.  In  many  respects, 
the  system  was  not  prepared  to  meet  an  "opera- 
tional" schedule. 

As  the  Space  Shuttle  system  matured,  with 
numerous  changes  and  compromises,  a  com- 
prehensive set  of  requirements  was  developed  to 
ensure  the  success  of  a  mission.  What  evolved  was 
a  system  in  which  the  preflight  processing,  flight 
planning,  flight  control  and  flight  training  were 
accomplished  with  extreme  care  applied  to  every 
detail.  This  process  checked  and  rechecked 
everything,  and  though  it  was  both  labor-  and 
time-intensive,  it  was  appropriate  and  necessary 
for  a  system  still  in  the  developmental  phase.  This 
process,  however,  was  not  capable  of  meeting  the 
flight  rate  goals. 

After  the  first  series  of  flights,  the  system 
developed  plans  to  accomplish  what  was  required 
to  support  the  flight  rate.  The  challenge  was  to 
streamline  the  processes  through  automation, 
standardization,  and  centralized  management, 
and  to  convert  from  the  developmental  phase  to 
the  mature  system  without  a  compromise  in 
quality.  It  required  that  experts  carefully  analyze 
their  areas  to  determine  what  could  be  standard- 
ized and  automated,  then  take  the  time  to  do  it. 

But  the  increasing  flight  rate  had  priority  — 
quality  products  had  to  be  ready  on  time.  Fur- 
ther, schedules  and  budgets  for  developing  the 
needed  facility  improvements  were  not  adequate. 
Only  the  time  and  resources  left  after  supporting 
the  flight  schedule  could  be  directed  toward  ef- 
forts to  streamline  and  standardize.  In  1985. 
NASA  was  attempting  to  develop  the  capabilities 
of  a  production  system.  But  it  was  forced  to  do 
that  while  responding  — with  the  same  person- 
nel—to a  higher  flight  rate. 

At  the  same  time  the  flight  rate  was  increas- 
ing, a  variety  of  factors  reduced  the  number  of 
skilled  personnel  available  to  deal  with  it.  These 
included  retirements,  hiring  freezes,  transfers  to 
other  programs  like  the  Space  Station  and  tran- 
sitioning to  a  single  contractor  for  operations 
support. 
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The  flight  rate  did  not  appear  to  be  based  on 
assessment  of  available  resources  and  capabilities 
and  was  not  reduced  to  accommodate  the  capacity 
of  the  work  force.  For  example,  on  January  1, 
1986,  a  new  contract  took  effect  at  Johnson  that 
consolidated  the  entire  contractor  work  force 
under  a  single  company.  This  transition  was 
another  disturbance  at  a  time  when  the  work  force 
needed  to  be  performing  at  full  capacity  to  meet 
the  1986  flight  rate.  In  some  important  areas,  a 
significant  fraction  of  workers  elected  not  to 
change  contractors.  This  reduced  the  work  force 
and  its  capabilities,  and  necessitated  intensive 
training  programs  to  qualify  the  new  personnel. 
According  to  projections,  the  work  force  would 
not  have  been  back  to  full  capacity  until  the  sum- 
mer of  1986.  This  drain  on  a  critical  part  of  the 
system  came  just  as  NASA  was  beginning  the 
most  challenging  phase  of  its  flight  schedule.6 

Similarly,  at  Kennedy  the  capabilities  of  the 
Shuttle  processing  and  facilities  support  work 
force  became  increasingly  strained  as  the  Orbiter 
turnaround  time  decreased  to  accommodate  the 
accelerated  launch  schedule.  This  factor  has 
resulted  in  overtime  percentages  of  almost  28  per- 
cent in  some  directorates.  Numerous  contract 
employees  have  worked  72  hours  per  week  or 
longer  and  frequent  12-hour  shifts.  The  poten- 
tial implications  of  such  overtime  for  safety  were 
made  apparent  during  the  attempted  launch  of 
mission  61 -C  on  January  6,  1986,  when  fatigue 
and  shiftwork  were  cited  as  major  contributing 
factors  to  a  serious  incident  involving  a  liquid 
oxygen  depletion  that  occurred  less  than  five 
minutes  before  scheduled  lift  off.  The  issue  of 
workload  at  Kennedy  is  discussed  in  more  detail 
in  Appendix  G. 

Another  example  of  a  system  designed  during 
the  developmental  phase  and  struggling  to  keep 
up  with  operational  requirements  is  the  Shuttle 
Mission  Simulator.  There  are  currently  two 
simulators.  They  support  the  bulk  of  a  crew's 
training  for  ascent,  orbit  and  entry  phases  of  a 
Shuttle  mission.  Studies  indicate  two  simulators 
can  support  no  more  than  12-15  flights  per  year. 
The  flight  rate  at  the  time  of  the  accident  was 
about  to  saturate  the  system's  capability  to  pro- 
vide trained  astronauts  for  those  flights.  Further- 
more, the  two  existing  simulators  are  out-of-date 
and  require  constant  attention  to  keep  them 
operating  at  capacity  to  meet  even  the  rate  of 
12-15  flights  per  year.  Although  there  are  plans 
to    improve    capability,    funds    for    those    im- 


provements are  minimal  and  spread  out  over  a 
10-year  period.  This  is  another  clear  demonstra- 
tion that  the  system  was  trying  to  develop  its 
capabilities  to  meet  an  operational  schedule  but 
was  not  given  the  time,  opportunity  or  resources 
to  do  it.7 

Responding  to  Challenges 
and  Changes 

Another  obstacle  in  the  path  toward  accom- 
modation of  a  higher  flight  rate  is  NASA's  legen- 
dary "can-do"  attitude.  The  attitude  that  enabled 
the  agency  to  put  men  on  the  moon  and  to  build 
the  Space  Shuttle  will  not  allow  it  to  pass  up  an 
exciting  challenge  — even  though  accepting  the 
challenge  may  drain  resources  from  the  more 
mundane  (but  necessary)  aspects  of  the  program. 

A  recent  example  is  NASA's  decision  to  per- 
form a  spectacular  retrieval  of  two  communica- 
tions satellites  whose  upper  stage  motors  had 
failed  to  raise  them  to  the  proper  geosynchronous 
orbit.  NASA  itself  then  proposed  to  the  insurance 
companies  who  owned  the  failed  satellites  that  the 
agency  design  a  mission  to  rendezvous  with  them 
in  turn  and  that  an  astronaut  in  a  jet  backpack 
fly  over  to  escort  the  satellites  into  the  Shuttle's 
payload  bay  for  a  return  to  Earth. 

The  mission  generated  considerable  excitement 
within  NASA  and  required  a  substantial  effort 
to  develop  the  necessary  techniques,  hardware 
and  procedures.  The  mission  was  conceived, 
created,  designed  and  accomplished  within  10 
months.  The  result,  mission  51 -A  (November, 
1984),  was  a  resounding  success,  as  both  failed 
satellites  were  successfully  returned  to  Earth.  The 
retrieval  mission  vividly  demonstrated  the  service 
that  astronauts  and  the  Space  Shuttle  can 
perform. 

Ten  months  after  the  first  retrieval  mission, 
NASA  launched  a  mission  to  repair  another  com- 
munications satellite  that  had  failed  in  low-Earth 
orbit.  Again,  the  mission  was  developed  and  ex- 
ecuted on  relatively  short  notice  and  was  resound- 
ingly successful  for  both  NASA  and  the  satellite 
insurance  industry. 

The  satellite  retrieval  missions  were  not  isolated 
occurrences.  Extraordinary  efforts  on  NASA's 
part  in  developing  and  accomplishing  missions 
will,  and  should,  continue,  but  such  efforts  will 
be  a  substantial  additional  drain  on  resources. 
NASA  cannot  both  accept  the  relatively  spur-of- 
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the-momen1  missions  that  its  "can-do"  attitude 
tends  to  generate  and  also  maintain  the  planning 
and  scheduling  discipline  required  to  operate  as 
a  "space  truck"  on  a  routine  and  cost-effective 
basis.  As  the  (light  rate  increases,  the  cost  in 
resources  and  the  accompanying  impact  on  future 
operations  must  be  considered  when  infrequent 
but  extraordinary  efforts  are  undertaken.  The 
system  is  still  not  sufficiently  developed  as  a  "pro- 
duction line"  process  in  terms  of  planning  or  im- 
plementation procedures.  It  cannot  routinely  or 
even  periodically  accept  major  disruptions 
without  considerable  cost.  NASA's  attitude 
historically  has  reflected  the  position  that  "We  can 
do  anything,"  and  while  that  may  essentially  be 
true.  NASA's  optimism  must  be  tempered  by  the 
realization  that  it  cannot  do  everything. 

NASA  has  always  taken  a  positive  approach 
to  problem  solving  and  has  not  evolved  to  the 
point  where  its  officials  are  willing  to  sav  they  no 
longer  have  the  resources  to  respond  to  proposed 
changes.  Harold  Draughon,  manager  of  the  Mis- 
sion Integration  Office  at  Johnson,  reinforced  this 
point  by  describing  what  would  have  to  happen 
in   l<>8h  to  achieve  the  flight  rate: 

"The  next  time  the  guy  came  in  and  said 
'I  want  to  get  off  this  flight  and  want  to  move 
down  two'  .  .  .  [the  system  would  have  had 
to  sav.]  'We  can't  do  that,'  and  that  would 
have  been  the  decision."8 

Even  in  the  event  of  a  hardware  problem,  after 
the  problem  is  fixed  there  is  still  a  choice  about 
how  to  respond.  Flight  41 -D  had  a  main  engine 
shutdown  on  the  launch  pad.  It  had  a  commer- 
cial payload  on  it.  and  the  NASA  Customer  Serv- 
ices division  wanted  to  put  that  commercial 
payload  on  the  next  flight  (replacing  some  NASA 
payloads)  to  satisfy  more  customers.  Draughon 
des(  ribed  the  effect  of  that  decision  to  the  Com- 
mission: "We  did  that.  We  did  not  have  to.  And 
die  system  went  out  and  put  that  in  work,  but 
it  paid  a  price.  The  next  three  or  four  flights  all 
slipped  as  a   result ."" 

NASA  was  being  too  bold  in  shuffling  mani- 
fests. The  total  resources  available  to  the  Shuttle 
program  tor  allocation  were  fixed.  As  time  went 
on.  the  agency  had  to  focus  those  resources  more 
and  more  on  the  near  term  —worrying  about  to- 
d.iv's  problem  and  not   focusing  on  tomorrow's. 

N  \s A  also  did  not  have  a  wa)  to  forecast  the 
effecl  of  a  change  of  a  manifest.  As  already  in- 
dicated, a  change  to  one  flight  ripples  through 
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the  manifest  and  typically  necessitates  changes  to 
many  other  flights,  each  requiring  resources 
(budget,  manpower,  facilities)  to  implement. 
Some  changes  are  more  expensive  than  others, 
but  all  have  an  impact,  and  those  impacts  must 
be  understood. 

In  fact,  Leonard  Nicholson,  manager  of  Space 
Transportation  System  Integration  and  Opera- 
tions at  Johnson,  in  arguing  for  the  development 
of  a  forecasting  tool,  illustrated  the  fact  that  the 
resources  were  spread  thin:  "The  press  of  busi- 
ness would  have  hindered  us  getting  that  kind  of 
tool  in  place,  just  the  fact  that  all  of  us  were 
busy  .   .   .  ."10 

The  effect  of  shuffling  major  payloads  can  be 
significant.  In  addition,  as  stated  earlier,  even  ap- 
parently "easy"  changes  put  demands  on  the 
resources  of  the  system.  Any  middeck  or  second- 
ary payload  has,  by  itself,  a  minimal  impact  com- 
pared with  major  payloads.  But  when  several 
changes  are  made,  and  made  late,  they  put  signifi- 
cant stress  on  the  flight  preparation  process  by 
diverting  resources  from  higher  priority  problems. 

Volume  III  of  JSC  07700,  Revision  B,  specifies 
that  all  middeck  experiments  must  be  scheduled, 
and  payload  specialists  assigned,  22  weeks  before 
launch.11  That  rule  has  not  been  enforced  — in 
fact,  it  is  more  honored  in  the  breach  than  in  the 
observance.  A  review  of  missions  41-G  through 
61-C  revealed  that  of  the  16  payload  specialists 
added  to  those  flights,  seven  were  added  after 
launch  minus  five  months. 

Even  "secondary"  payloads  take  a  lot  of  time 
and  attention  when  they  are  added  to  a  flight  late. 
Harold  Draughon: 

"I  spend  more  than  half  of  my  time  work- 
ing on  things  that  are  not  very  important 
because  they  get  put  in  so  late.  Rather  than 
working  on  PAM's  [Payload  Assist  Modules] 
and  IUS's  [Inertial  Upper  Stages],  I  am 
working  on  chicken  eggs."12 

Those  directing  the  changes  in  the  manifest 
were  not  yet  sensitive  to  the  problem.  Each 
(  hange  nibbles  away  at  the  operational  resources, 
and  the  changes  were  occurring  frequently, 
even  routinely.  Much  of  the  capacity  of  the 
system  was  being  used  up  responding  to  late 
changes  in  lower  priority  experiments.  That  flexi- 
bility toward  secondary  experiments  tied  up  the 
resources  that  would  have  been  better  spent  build- 
ing capability  to  meet  the  projected  flight  rate. 


Tommy  Holloway,  chief  of  the  Johnson  Flight 
Director  Office,  emphasized  that,  given  finite 
resources,  one  must  decide:  "It's  flight  rate  ver- 
sus [manifest]  flexibility."13 

The  portion  of  the  system  forced  to  respond 
to  the  late  changes  in  the  manifest  tried  to  bring 
its  concerns  to  Headquarters.  As  Mr.  Nicholson 
explained, 

"We  have  done  enough  complaining  about 
it  that  I  cannot  believe  there  is  not  a  grow- 
ing awareness,  but  the  political  aspects  of  the 
decision  are  so  overwhelming  that  our  con- 
cerns do  not  carry  much  weight.  .  .  .  The 
general  argument  we  gave  about  distracting 
the  attention  of  the  team  late  in  the  process 
of  implementing  the  flight  is  a  qualitative 
argument  ....  And  in  the  face  of  that, 
political  advantages  of  implementing  those 
late  changes  outweighed  our  general 
objections."14 

It  is  important  to  determine  how  many  flights 
can  be  accommodated,  and  accommodated  safe- 
ly. NASA  must  establish  a  realistic  level  of  ex- 
pectation, then  approach  it  carefully.  Mission 
schedules  should  be  based  on  a  realistic  assess- 
ment of  what  NASA  can  do  safely  and  well,  not 
on  what  is  possible  with  maximum  effort  The 
ground  rules  must  be  established  firmly,  and  then 
enforced. 

The  attitude  is  important,  and  the  word  opera- 
tional can  mislead.  "Operational"  should  not  im- 
ply any  less  commitment  to  quality  or  safety,  nor 
a  dilution  of  resources.  The  attitude  should  be, 
"We  are  going  to  fly  high  risk  flights  this  year; 
every  one  is  going  to  be  a  challenge,  and  every 
one  is  going  to  involve  some  risk,  so  we  had  bet- 
ter be  careful  in  our  approach  to  each."15 


Effect  of  Flight  Rate  on  Spare  Parts 

As  the  flight  rate  increases,  the  demand  on 
resources  and  the  demand  for  spare  parts  in- 
creases. Since  1981 ,  NASA  has  had  logistics  plans 
for  Shuttle  flight  rates  of  12  and  24  flights  a  year. 
It  was  originally  forecast  (in  mid- 1983)  that  the 
supply  of  spares  required  to  support  12  flights  an- 
nually could  be  accomplished  in  the  spring  of 
1986.  Actual  inventory  of  spare  parts  had  run 
close  to  plan  until  the  second  quarter  of  fiscal  year 
1985.  At  that  time,  inventory  requirements  for 


spares  began  to  increase  faster  than  deliveries. 
A  year  later,  when  inventory  stockage  should 
have  been  complete,  only  32,000  of  the  required 
50,000  items  (65  percent)  had  been  delivered.16 

The  spare  parts  plan  to  support  24  flights  per 
year  had  called  for  completing  inventory  stockage 
by  June,  1987.  By  mid-1985,  that  schedule  was 
in  jeopardy. 

The  logistics  plan  could  not  be  fully  im- 
plemented because  of  budget  reductions.  In  Oc- 
tober, 1985,  the  logistics  funding  requirement  for 
the  Orbiter  program,  as  determined  by  Level  III 
management  at  Johnson,  was  $285.3  million. 
That  funding  was  reduced  by  $83.3  million  — a 
cut  that  necessitated  major  deferrals  of  spare  parts 
purchases.  Purchasing  deferrals  come  at  great 
cost.  For  example,  a  reduction  due  to  deferral  of 
$11.2  million  in  fiscal  year  1 986  would  cost  $11.2 
million  in  fiscal  year  1987,  plus  an  additional 
$21.6  million  in  fiscal  year  1988.  This  three-to- 
one  ratio  of  future  cost  to  current  savings  is  not 
uncommon.  Indeed,  the  ratio  in  many  instances 
is  as  high  as  seven  to  one.  This  practice  cannot 
make  sense  by  any  standard  of  good  financial 
management. 

According  to  Johnson  officials,  reductions  in 
spares  expenditures  provided  savings  required  to 
meet  the  revised  budgets.  As  Program  Manager 
Arnold  Aldrich  reported  to  the  Commission: 

"There  had  been  fund  contentions  in  the 
program  for  a  number  of  years,  at  least  start- 
ing in  the  mid-seventies  and  running 
through  into  the  early  to  mid-eighties  .  .  . 
intentional  decisions  were  made  to  defer  the 
heavy  build-up  of  spare  parts  procurements 
in  the  program  so  that  the  funds  could  be 
devoted  to  other  more  pressing  activities. 
...  It  was  a  regular  occurrence  for  several 
annual  budget  cycles.  And  once  the  flight 
rate  really  began  to  rise  and  it  was  really- 
clear  that  spare  parts  were  going  to  be  a 
problem,  significant  attention  was  placed  on 
that  problem  by  all  levels  of  NASA  and  ef- 
forts had  been  made  to  catch  up.  But  .  .  . 
our  parts  availability  is  well  behind  the  flight 
need.  .  .  ."17 

Those  actions  resulted  in  a  critical  shortage  of 
serviceable  spare  components.  To  provide  parts 
required  to  support  the  flight  rate,  NASA  had  to 
resort  to  cannibalization.  Extensive  cannibaliza- 
tion  of  spares,  i.e.,  the  removal  of  components 
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from  one  Orbiter  for  installation  in  another. 
became  an  essential  modus  operandi  in  order  to 
maintain  flight  schedules.  Forty-five  out  of  ap- 
proximately 300  required  parts  were  cannibalized 
for  Challenger  before  mission  51-L.  These  parts 
spanned  the  spectrum  from  common  bolts  to  a 
thrust  control  actuator  for  the  orbital  maneuver- 
ing system  to  a  fuel  cell.  This  practice  is  costly 
and  disruptive,  and  it  introduces  opportunities 
for  component  damage. 

This  concern  was  summarized  in  testimony 
before  the  Commission  by  Paul  Weitz,  deputy 
chief  of  the  Astronaut  Office  at  Johnson: 

"It  increases  the  exposure  of  both  Orbiters 
to  intrusion  by  people.  Every  time  you  get 
people  inside  and  around  the  Orbiter  you 
stand  a  chance  of  inadvertent  damage  of 
whatever  type,  whether  you  leave  a  tool 
behind  or  whether  you.  without  knowing  it. 
step  on  a  wire  bundle  or  a  tube  or  something 
along  those  lines."  18 

Cannibalization  is  a  potential  threat  to  flight 
safety,  as  parts  are  removed  from  one  Orbiter, 
installed  in  another  Orbiter.  and  eventually 
replaced.  Each  handling  introduces  another  op- 
portunity for  imperfections  in  installation  and  for 
damage  to  the  parts  and  spacecraft. 

Cannibalization  also  drains  resources,  as  one 
Kennedy  official  explained  to  the  Commission  on 
March  5.  1986: 

"It  creates  a  large  expenditure  in  man- 
power at  KSC.  A  job  that  you  would  have 
normally  used  what  we  will  call  one  unit  of 
effort  to  do  the  job  now  requires  two  units 
of  effort  because  you've  got  two  ships  [Or- 
biters] to  do  the  task  with."  19 

Prior  to  the  Challenger  accident,  the  shortage 
ol  spare  parts  had  no  serious  impact  on  flight 
schedules,  but  cannibalization  is  possible  only  so 
long  as  Orbiters  from  which  to  borrow  are 
available.  In  the  spring  of  1986.  there  would  have 
been  no  Orbiters  to  use  as  "spare  parts  bins.*' 
( 'olumbia  was  to  tlv  in  March.  Discovery  was  to 
be  sent  to  Yandenberg,  and  Atlantis  and 
( 'hallenger  were  to  fly  in  May.  In  a  Commission 
interview  .  Kennedy  director  of  Shuttle  Engineer- 
ing Horace  Lamberth  predicted  the  program 
would  have  been  unable  to  continue. 

"I  think  we  would  have  been  brought  to 


our  knees  this  spring  [1986]  by  this  problem 
[spare  parts]  if  we  had  kept  trying  to  fly."  20 

NASA's  processes  for  spares  provisioning 
(determining  the  appropriate  spares  inventory 
levels),  procurement  and  inventory  control  are 
complicated  and  could  be  streamlined  and 
simplified. 

As  of  spring  1986,  the  Space  Shuttle  logistics 
program  was  approximately  one  year  behind. 
Further,  the  replenishment  of  all  spares  (even 
parts  that  are  not  currently  available  in  the 
s\  stem)  has  been  stopped.  Unless  logistics  sup- 
port is  improved,  the  ability  to  maintain  even  a 
three-Orbiter  fleet  is  in  jeopardy. 

Spare  parts  provisioning  is  yet  another  illustra- 
tion that  the  Shuttle  program  was  not  prepared 
for  an  operational  schedule.  The  policy  was  short- 
sighted and  led  to  cannibalization  in  order  to  meet 
the  increasing  flight  rate. 


The  Importance  of 
Flight  Experience 

In  a  developmental  program  it  is  important  to 
make  use  of  flight  experience,  both  to  understand 
the  system's  actual  performance  and  to  uncover 
problems  that  might  not  have  been  discovered  in 
testing.  Because  Shuttle  flights  were  coming  in 
fairly  rapid  succession,  it  was  becoming  difficult 
to  analyze  all  the  data  from  one  flight  before  the 
next  was  scheduled  to  launch.  In  fact,  the  Flight 
Readiness  Review  for  51-L  was  held  while  mis- 
sion 61-C  was  still  in  orbit.  Obviously,  it  was  im- 
possible to  even  present,  much  less  analyze  and 
understand,  anomalies  from  that  flight. 

The  point  can  be  emphasized  by  citing  two 
problems  that  occurred  during  mission  61-C  but 
were  discovered  too  late  to  be  considered  at  the 
51-L  Flight  Readiness  Review: 

1 .  The  Space  Shuttle  brakes  and  tires  have 
long  been  a  source  of  concern.  In  particular, 
after  the  51-D  Orbiter  blew  a  tire  at  Ken- 
nedy in  April.  1985.  there  was  considerable 
effort  (within  budgetary  constraints)  to 
understand  and  resolve  the  problems,  and 
Kennedy  landings  were  suspended  until  cer- 
tain improvements  were  made.  (See  section 
"Landing:  Another  Critical  Phase."  page  186.) 
Mission  51-L  was  to  be  the  first  flight  to  land 
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in  Florida  since  51-D  had  experienced  brake 
problems.  STS  61-C  landed  at  Edwards  Air 
Force  Base  in  California  on  January  19, 
1986,  four  days  after  the  51-L  Flight 
Readiness  Review.  The  61-C  brakes  were 
removed  following  landing  and  shipped  to 
the  vendor  for  further  inspection  and 
analysis.  That  inspection  revealed  major 
brake  damage.  The  subsystem  manager  at 
Johnson  in  charge  of  the  brakes  did  not 
receive  the  information  until  January  27, 
1986,  one  day  before  51-L  was  launched, 
and  did  not  learn  the  extent  of  the  problem 
until  January  30,  1986. 

2.  The  inspection  of  the  61-C  Solid  Rocket 
Booster  segments  was  completed  on  January 
19,  1986,  four  days  after  the  51-L  Level  I 
Flight  Readiness  Review.  The  post-recovery 
inspection  of  the  61-C  Solid  Rocket  Booster 
segments  revealed  that  there  was  O-ring  ero- 
sion in  one  of  the  left  booster  field  joints  and 
additional  O-ring  anomalies  on  both  booster 
nozzles.  Although  the  information  was 
available  for  Marshall's  51-L  Level  III 
review  at  launch  minus  one  day,  it  was  clear- 
ly not  available  in  time  for  consideration  in 
the  formal  launch  preparation  process.21 
These  examples  underscore  the  need  to 
establish  a  list  of  mandatory  post-flight  in- 
spections that  must  precede  any  subsequent 
launch. 


Effect  on  Payload  Safety 

The  payload  safety  process  exists  to  ensure  that 
each  Space  Shuttle  payload  is  safe  to  fly  and  that 
on  a  given  mission  the  total  integrated  cargo  does 
not  create  a  hazard.  NASA  policy  is  to  minimize 
its  involvement  in  the  payload  design  process. 
The  payload  developer  is  responsible  for  produc- 
ing a  safe  design,  and  the  developer  must  verify 
compliance  with  NASA  safety  requirements.  The 
Payload  Safety  Panel  at  Johnson  conducts  a 
phased  series  of  safety  reviews  for  each  payload. 
At  those  reviews,  the  payload  developer  presents 
material  to  enable  the  panel  to  assess  the  payload's 
compliance  with  safety  requirements. 

Problems  may  be  identified  late,  however, 
often  as  a  result  of  late  changes  in  the  payload 
design  and  late  inputs  from  the  payload 
developer.  Obviously,  the  later  a  hazard  is  iden- 


tified, the  more  difficult  it  will  be  to  correct,  but 
the  payload  safety  process  has  worked  well  in 
identifying  and  resolving  safety  hazards. 

Unfortunately,  pressures  to  maintain  the  flight 
schedule  may  influence  decisions  on  payload  safe- 
ty provisions  and  hazard  acceptance.  This  in- 
fluence was  evident  in  circumstances  surrounding 
the  development  of  two  high  priority  scientific 
payloads  and  their  associated  booster,  the 
Centaur. 

Centaur  is  a  Space  Shuttle-compatible  booster 
that  can  be  used  to  carry  heavy  satellites  from  the 
Orbiter's  cargo  bay  to  deep  space.  It  was  sched- 
uled to  fly  on  two  Shuttle  missions  in  May,  1986, 
sending  the  NASA  Galileo  spacecraft  to  Jupiter 
and  the  European  Space  Agency  Ulysses  space- 
craft first  to  Jupiter  and  then  out  of  the  planets' 
orbital  plane  over  the  poles  of  the  Sun.  The 
pressure  to  meet  the  schedule  was  substantial 
because  missing  launch  in  May  or  early  June 
meant  a  year's  wait  before  planetary  alignment 
would  again  be  satisfactory. 

Unfortunately,  a  number  of  safety  and 
schedule  issues  clouded  Centaur's  use.  In  par- 
ticular, Centaur's  highly  volatile  cryogenic  pro- 
pellants  created  several  problems.  If  a  return-to- 
launch-site  abort  ever  becomes  necessary,  the 
propellants  will  definitely  have  to  be  dumped 
overboard.  Continuing  safety  concerns  about  the 
means  and  feasibility  of  dumping  added  pressure 
to  the  launch  preparation  schedule  as  the  program 
struggled  to  meet  the  launch  dates. 

Of  four  required  payload  safety  reviews,  Cen- 
taur had  completed  three  at  the  time  of  the 
Challenger  accident,  but  unresolved  issues  re- 
mained from  the  last  two.  In  November,  1985, 
the  Payload  Safety  Panel  raised  several  impor- 
tant safety  concerns.  The  final  safety  review, 
though  scheduled  for  late  January,  1986,  ap- 
peared to  be  slipping  to  February,  only  three 
months  before  the  scheduled  launches. 

Several  safety  waivers  had  been  granted,  and 
several  others  were  pending.  Late  design  changes 
to  accommodate  possible  system  failure  would 
probably  have  required  reconsideration  of  some 
of  the  approved  waivers.  The  military  version  of 
the  Centaur  booster,  which  was  not  scheduled  to 
fly  for  some  time,  was  to  be  modified  to  provide 
added  safety,  but  because  of  the  rush  to  get  the 
1986  missions  launched,  these  improvements 
were  not  approved  for  the  first  two  Centaur 
boosters.  After  the  51-L  accident,  NASA  allotted 
more  than  $75  million  to  incorporate  the  opera- 
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tional  and  safety  improvements  to  these  two 
vehicles.22  We  will  never  know  whether  the 
pavload  safety  program  would  have  allowed  the 
Centaur  missions  to  fly  in  1986.  Had  they  flown, 
however,  they  would  have  done  so  without  the 
level  of  protection  deemed  essential  after  the 
accident. 

Outside  Pressure  to  Launch 

After  the  accident,  rumors  appeared  in  the 
press  to  the  effect  that  persons  who  made  the  deci- 
sion to  launch  mission  51-L  might  have  been  sub- 
jected to  outside  pressure  to  launch.  Such  rumors 
concerning  unnamed  persons,  emanating  from 
anonymous  sources  about  events  that  may  never 
have  happened,  are  difficult  to  disprove  and 
dispel.  Nonetheless,  during  the  Commission's 
hearings  all  persons  who  played  key  roles  in  that 
decision  were  questioned.  Each  one  attested, 
under  oath,  that  there  had  been  no  outside  in- 
tervention or  pressure  of  any  kind  leading  up  to 
the  launch. 

There  was  a  large  number  of  other  persons  who 
were  invoked  to  a  lesser  extent  in  that  decision, 
and  they  were  questioned.  All  of  those  persons 
provided  the  Commission  with  sworn  statements 
that  they  knew  of  no  outside  pressure  or 
intervention.23 

The  Commission  and  its  staff  also  questioned 
a  large  number  of  other  witnesses  during  the 
course  of  the  investigation.  No  evidence  was 
reported  to  the  Commission  which  indicated  that 
any  attempt  was  ever  made  by  anyone  to  apply 
pressure  on  those  making  the  decision  to  launch 
the  Challenger. 

Although  there  was  total  lack  of  evidence  that 
any  outside  pressure  was  ever  exerted  on  those 
who  made  the  decision  to  launch  51-L,  a  few 
speculative  reports  persisted. 

One  rumor  was  that  plans  had  been  made  to 
have  a  live  communication  hookup  with  the  51-L 
crew  during  the  State  of  the  Union  Message. 
Commission  investigators  interviewed  all  of  the 
persons  who  would  have  been  involved  in  a 
hookup  if  one  had  been  planned,  and  all  stated 
unequivo<  ally  that  there  was  no  such  plan.  Fur- 
thermore, to  give  the  crew  time  to  become 
oriented,  NASA  does  not  schedule  a  communica- 
tion for  at  least  48  hours  after  the  launch  and  no 
such  communication  was  scheduled  in  the  case 
of  flight  51-L. 
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The  flight  activity  officer  who  was  responsible 
for  developing  the  crew  activity  plan  testified  that 
three  live  telecasts  were  planned  for  the 
Challenger,  but  they  related  in  no  way  to  the 
State  of  the  Union  Message:24 

■  During  the  teacher  activities  on  flight  day  4. 

■  During  the  phase  partitioning  experiment 
on  flight  day  5. 

■  During  the  crew  conference  on  flight  day  6. 

The  Commission  concluded  that  the  decision 
to  launch  the  Challenger  was  made  solely  by  the 
appropriate  NASA  officials  without  any  outside 
intervention  or  pressure. 


Findings 

1 .  The  capabilities  of  the  system  were  stretched 
to  the  limit  to  support  the  flight  rate  in  winter 
1985/1986.  Projections  into  the  spring  and  sum- 
mer of  1986  showed  a  clear  trend;  the  system, 
as  it  existed,  would  have  been  unable  to  deliver 
crew  training  software  for  scheduled  flights  by  the 
designated  dates.  The  result  would  have  been  an 
unacceptable  compression  of  the  time  available 
for  the  crews  to  accomplish  their  required 
training. 

2.  Spare  parts  are  in  critically  short  supply.  The 
Shuttle  program  made  a  conscious  decision  to 
postpone  spare  parts  procurements  in  favor  of 
budget  items  of  perceived  higher  priority.  Lack 
of  spare  parts  would  likely  have  limited  flight 
operations  in  1986. 

3.  Stated  manifesting  policies  are  not  enforced. 
Numerous  late  manifest  changes  (after  the  cargo 
integration  review)  have  been  made  to  both  ma- 
jor payloads  and  minor  payloads  throughout  the 
Shuttle  program. 

■  Late  changes  to  major  payloads  or  pro- 
gram requirements  can  require  extensive 
resources  (money,  manpower,  facilities) 
to  implement. 

■  If  many  late  changes  to  "minor"  payloads 
occur,  resources  are  quickly  absorbed. 

■  Payload  specialists  frequently  were  added 
to  a  flight  well  after  announced  deadlines. 

■  Late  changes  to  a  mission  adversely  af- 
fect the  training  and  development  of  pro- 
cedures for  subsequent  missions. 
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4.  The  scheduled  flight  rate  did  not  accurate- 
ly reflect  the  capabilities  and  resources. 

■  The  flight  rate  was  not  reduced  to  accom- 
modate periods  of  adjustment  in  the 
capacity  of  the  work  force.  There  was  no 
margin  in  the  system  to  accommodate  un- 
foreseen hardware  problems. 

■  Resources  were  primarily  directed  toward 
supporting  the  flights  and  thus  not 
enough  were  available  to  improve  and  ex- 
pand facilities  needed  to  support  a  higher 
flight  rate. 

5.  Training  simulators  may  be  the  limiting  fac- 
tor on  the  flight  rate:  the  two  current  simulators 
cannot  train  crews  for  more  than  12-15  flights  per 
year. 

6.  When  flights  come  in  rapid  succession,  cur- 
rent requirements  do  not  ensure  that  critical 
anomalies  occurring  during  one  flight  are  iden- 
tified and  addressed  appropriately  before  the  next 
flight.  B 
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Chapter  IX 


Other  Safety 
Considerations 


In  the  course  of  its  investigation,  the  Com- 
mission became  aware  of  a  number  of  mat- 
ters that  played  no  part  in  the  mission  51-L 
accident  but  nonetheless  hold  a  potential  for 
safety  problems  in  the  future. 

Some  of  these  matters,  those  involving  opera- 
tional concerns,  were  brought  directly  to  the 
Commission's  attention  by  the  NASA  astronaut 
office.  They  were  the  subject  of  a  special  hearing. 
Other  areas  of  concern  came  to  light  as  the 
Commission  pursued  various  lines  of  investiga- 
tion in  its  attempt  to  isolate  the  cause  of  the  acci- 
dent. These  inquiries  examined  such  aspects  as 
the  development  and  operation  of  each  of  the 
elements  of  the  Space  Shuttle  — the  Orbiter,  its 
main  engines  and  the  External  Tank;  the  pro- 
cedures employed  in  the  processing  and  assembly 
of  51-L,  and  launch  damage. 

This  chapter  examines  potential  risks  in  two 
general  areas.  The  first  embraces  critical  aspects 
of  a  Shuttle  flight;  for  example,  considerations 
related  to  a  possible  premature  mission  termina- 
tion during  the  ascent  phase  and  the  risk  factors 
connected  with  the  demanding  approach  and 
landing  phase.  The  other  focuses  on  testing,  proc- 
essing and  assembling  the  various  elements  of  the 
Shuttle. 


Ascent:  A  Critical  Phase 

The  events  of  flight  51-L  dramatically  il- 
lustrated the  dangers  of  the  first  stage  of  a  Space 
Shuttle  ascent.  The  accident  also  focused  atten- 
tion on  the  issues  of  Orbiter  abort  capabilities  and 
crew  escape.  Of  particular  concern  to  the  Com- 
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mission  are  the  current  abort  capabilities,  options 
to  improve  those  capabilities,  options  for  crew 
escape  and  the  performance  of  the  range  safety 
system. 

It  is  not  the  Commission's  intent  to  second- 
guess  the  Space  Shuttle  design  or  try  to  depict 
escape  provisions  that  might  have  saved  the  51-L 
crew.  In  fact,  the  events  that  led  to  destruction 
of  the  Challenger  progressed  very  rapidly  and 
without  warning.  Under  those  circumstances,  the 
Commission  believes  it  is  highly  unlikely  that  any 
of  the  systems  discussed  below,  or  any  combina- 
tion of  those  systems,  would  have  saved  the  flight 
51-L  crew. 

Abort  Capabilities 

Various  unexpected  conditions  during  ascent 
can  require  premature  termination  of  a  Shuttle 
mission.  The  method  of  termination,  or  abort, 
depends  upon  the  nature  of  the  unexpected  con- 
dition and  when  it  occurs. 

The  Space  Shuttle  is  lifted  to  orbit  by  thrust 
from  its  two  solid  rockets  and  three  main  engines. 
The  design  criteria  for  the  Shuttle  specify  that, 
if  a  single  main  engine  is  lost  at  any  time  between 
lift  off  and  normal  main  engine  cut  off,  the  Shuttle 
must  be  able  to  continue  to  orbit  or  to  execute 
an  intact  abort,  that  is,  make  a  survivable  land- 
ing on  a  runway.  That  design  requirement  has 
been  met.  If  a  single  main  engine  is  lost  earlv  in 
ascent,  the  Shuttle  can  return  to  make  an 
emergency  landing  at  Kennedy  (a  return-to- 
launch-site  abort).  If  the  failure  occurs  later,  the 
Shuttle  can  make  an  emergency  landing  in  Africa 
or  Europe  (a  transatlantic  abort  landing).  If  the 
failure  occurs  during  the  last  part  of  the  ascent, 
the  Shuttle  can  proceed  around  the  Earth  to  a 


landing  in  the  continental  United  States  (abort 
once  around),  or  can  continue  to  a  lower-than- 
planned  orbit  (abort  to  orbit).  Indeed,  if  the 
failure  occurs  late  enough,  the  Shuttle  will  achieve 
the  intended  orbital  conditions. 

Return-to-Launch-Site  Abort.  If  the  termina- 
tion is  necessary  because  of  loss  of  a  main  engine 
during  the  first  four  minutes  of  flight,  the  Shut- 
tle has  the  capability  to  fly  back  to  the  launch  site. 
It  continues  downrange  to  burn  excess  propellant, 
and  at  the  proper  point  it  turns  back  toward 
Florida.  The  computers  shutdown  the  remaining 
two  engines  and  separate  the  Orbiter  from  the 
External   Tank,    which   falls   into   the   Atlantic 


Ocean.  The  Orbiter  then  glides  to  a  landing  on 
the  runway  at  the  Shuttle  Landing  Facility  at 
Kennedy. 

Transatlantic  Abort.  During  ascent  there 
comes  a  time  when  the  Shuttle  is  too  far 
downrange  to  fly  back  to  Kennedy.  If  it  suffers 
an  engine  failure  after  that  point,  but  has  not  yet 
achieved  enough  energy  to  continue  toward  or- 
bit, it  will  have  to  land  on  the  other  side  of  the 
Atlantic.  It  will  continue  on  a  special  flight  path 
until  it  achieves  the  energy  necessary  to  glide  to 
the  landing  site.  At  that  point  the  Shuttle  com- 
puters will  cut  off  the  two  remaining  engines  and 
separate  the  Orbiter  from  the  External  Tank.  The 


Shuttle  Abort  Regions 
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Schematic  shows  options  available  to  Space  Shuttle  crews  for 
aborts  in  the  event  of  power  loss  at  various  stages  in  the 
ascent  to  space. 
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Shuttle  will  then  re-enter  the  lower  atmosphere 
much  like  a  normal  entry.  The  landing,  however, 
will  be  at  a  pre-selected  site  in  Africa  or  Europe. 

Design.  The  Shuttle  design  specifications  do 
not  require  that  the  Orbiter  be  able  to  manage 
an  intact  abort  (i.e.,  make  it  to  a  runway)  if  a 
second  main  engine  should  fail.  If  two  (or  all 
three)  main  engines  fail  within  the  first  five  to  six 
minutes  of  the  flight,  the  Space  Shuttle  will  land 
in  water.  This  maneuver  is  called  a  "contingen- 
cy abort"  and  is  not  believed  to  be  survivable 
because  of  damage  incurred  at  water  impact. 

The  Shuttle  design  requirements  did  not 
specify  that  the  Shuttle  should  be  able  to  survive 
a  Solid  Rocket  Booster  failure.  The  system  has 
no  way  to  identify  when  a  booster  is  about  to  fail, 
and  no  way  to  get  the  Orbiter  or  the  crew  away 
from  a  failing  Solid  Rocket  Booster. 

Crew  survival  during  ascent  rests  on  the  follow- 
ing assumptions: 

1 .  The  Solid  Rocket  Boosters  will  work 
from  ignition  to  planned  separation. 

2.  If  more  than  one  main  engine  fails,  the 
crew  must  be  able  to  survive  a  water  landing. 

Shuttle  Abort  Enhancements 

Between  1973  and  1983,  first  stage  abort  pro- 
visions were  assessed  many  times  by  all  levels  of 
NASA  management.  Many  methods  of  saving 
the  Orbiter  and/or  crew  from  emergencies  dur- 
ing first  stage  were  considered. 

Ejection  seats  (which  afforded  only  limited  pro- 
tection during  first  stage)  were  provided  for  the 
two-man  crews  of  the  Orbital  Flight  Test  program 
(the  first  four  Shuttle  flights).  Other  options  for 
"operational"  flights  carrying  crews  of  five  or  more 
astronauts  were  considered,  but  were  not  im- 
plemented because  of  limited  utility,  technical 
complexity  and  excessive  cost  in  dollars,  weight 
or  schedule  delays. 

Because  of  these  factors,  NASA  adopted  the 
philosophy  that  the  reliability  of  first  stage  ascent 
must  be  assured,  and  that  design  and  testing  must 
preclude  time  critical  failures  that  would  require 
emergency  action  before  normal  Solid  Rocket 
Booster  burnout.  That  philosophy  has  been 
reviewed  many  times  during  the  Space  Shuttle 
program  and  is  appropriately  being  reevaluated, 
as  are  all  first  stage  abort  options,  in  light  of  the 
51-L  accident. 


Early  Orbiter  Separation 

It  a  problem  arose  that  required  the  Orbiter 
to  get  away  from  failing  Solid  Rocket  Boosters, 
the  separation  would  have  to  be  performed  ex- 
tremely quickly.  Time  would  be  of  the  essence 
for  two  reasons.  First,  as  51-L  demonstrated,  if 
a  problem  develops  in  a  Solid  Rocket  Booster, 
it  can  escalate  very  rapidly.  Second,  the  ascent 
trajectory  is  carefully  designed  to  control  the 
aerodynamic  loads  on  the  vehicle;  very  small 
deviation  from  the  normal  path  will  produce  ex- 
cessive loads,  so  if  the  vehicle  begins  to  diverge 
from  its  path  there  is  very  little  time  (seconds) 
before  structural  breakup  will  occur. 

The  normal  separation  sequence  to  free  the 
Shuttle  from  the  rest  of  the  system  takes  18 
seconds,  far  too  long  to  be  of  use  during  a  first- 
stage  contingency.  "Fast-separation"  was  formally 
established  by  Review  Item  Discrepancy 
03.00.151,  which  stated  the  requirement  to 
separate  the  Orbiter  from  the  External  Tank  at 
any  time.  The  sequence  was  referred  to  as  fast- 
separation  because  delays  required  during  nor- 
mal separation  were  bypassed  or  drastically 
shortened  in  order  to  achieve  separation  in  ap- 
proximately three  seconds.  Some  risk  was  ac- 
cepted to  obtain  this  contingency  capability.  Fast- 
separation  was  incorporated  into  the  flight  soft- 
ware, so  that  technically  this  capability  does  exist. 
Unfortunately,  analysis  has  shown  that,  if  it  is 
attempted  while  the  Solid  Rocket  Boosters  are  still 
thrusting,  the  Orbiter  will  "hang  up"  on  its  aft 
attach  points  and  pitch  violently,  with  probable 
loss  of  the  Orbiter  and  crew. 

In  summary,  as  long  as  the  Solid  Rocket 
Boosters  are  still  thrusting,  fast-separation  does 
not  provide  a  way  to  escape.  It  would  be  useful 
during  first  stage  only  if  Solid  Rocket  Booster 
thrust  could  first  be  terminated. 

The  current  concept  of  fast-separation  does, 
however,  have  some  use.  Contingency  aborts 
resulting  from  loss  of  two  or  three  main  engines 
early  in  ascent  are  time-critical,  and  every  frac- 
tion of  a  second  that  can  be  trimmed  from  the 
separation  sequence  helps.  These  abort  pro- 
cedures are  executed  after  the  Solid  Rocket 
Boosters  are  expended,  and  fast-separation  is  used 
to  reduce  the  time  required  for  separation  as  the 
Shuttle  must  attain  entry  attitude  very  quickly. 
Unfortunately,  all  contingency  aborts  culminate 
in  water  impact. 
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Thrust  Termination 

Thrust  termination  (or  thrust  neutralization) 
as  originally  proposed  for  the  Space  Shuttle  was 
a  concept  conceived  for  the  Titan  3-M  booster 
intended  for  use  in  the  Manned  Orbiting 
Laboratory  Program.  The  objective  of  thrust  ter- 
mination is  to  either  extinguish  or  reduce  the 
thrust  of  the  Solid  Rocket  Booster  in  an  emergen- 
cy situation.  With  this  thrust  terminated, 
emergency  options  such  as  crew  ejection  or  fast- 
separation  might  become  feasible  during  the  first 
two  minutes  of  flight. 

The  principajjdrawbacki is  that  thrust  termina- 
tion itself  introduces  Tm^i^cIynlirnTc  loads  that 
coulcTcause  Shuttle  stracturaTcomponents  tojail . 
Early  design  reviews  suggested  that  to  strengthen 
the  Orbiter  to  withstand  the  stresses  caused  by 
rapid  thrust  termination  would  require  an  addi- 
tional, prohibitive  19.600  pounds.  Thrust  ter- 
mination was  deleted  from  design  consideration 
on  April  27,  1973.  by  Space  Shuttle  Directive 
SS00040.  Key  factors  in  the  decision  were  that 
(1)  proper  design  would  be  stressed  to  prevent 
Solid  Rocket  Booster  failure  and  (2)  other  first- 
stage  ascent  systems  provided  enough  redundan- 
cy to  allow  delaying  an  abort  until  after  the  Solid 
Rocket  Boosters  burned  out. 

The  subject  arose  again  in  1979  when  Space 
Shuttle  Directive  S13141  required  the  system  con- 
tractor to  determine  the  time  over  which  thrust 
reduction  must  be  spread  so  that  the  deceleration 
loads  would  not  destroy  the  Orbiter.  Marshall 
analyzed  the  thrust  decay  curves  submitted  by 
the  contractor  and  concluded  that  achieving  the 
required  thrust  decay  rates  was  impractical. 

On  July  12,  1982,  the  Associate  Administrator 
for  Space  Transportation  Systems  requested 
reconsideration  of  thrust  termination.  Gerald 
Griffin,  director  of  Johnson,  responded  to  the  re- 
quest in  a  letter  dated  September  9,  1982,  as 
follows: 

"In  our  opinion,  further  study  of  a  thrust 
termination  system  for  the  SRB  [Solid 
Rocket  Booster]  would  not  be  productive. 
The  potential  failure  modes  which  could 
result  in  a  set  of  conditions  requiring  SRB 
thrust  termination  are  either  very  remote  or 
a  result  of  primary  structural  failure.  The 
structural  failure  risk  would  normally  be  ac- 
cepted as  a  part  of  the  factor  of  safety 
verification  by  analysis  or  test.  In  addition, 
any  thrust  termination  system  is  going  to  be 


extremely  heavy,  very  costly  and,  at  best, 
present  some  risk  to  the  Orbiter  and  ET  [Ex- 
ternal Tank].  Venting  of  hot  gases  and  the 
shock  load  or  pressure  spike,  have  the  poten- 
tial for  being  as  great  a  hazard  as  the  prob- 
lem to  be  corrected.  It  does  not  appear  that 
a  practical  approach  exists  for  achieving  the 
desired  pressure  decay  rate  without  a  ma- 
jor redesign  of  the  motor."1 

In  retrospect,  the  possibility  of  Solid  Rocket 
Booster  failures  was  neither  very  remote  nor 
limited  to  primary  structural  failure. 

Although  it  would  not  have  helped  on  mission 
51-L.  thrust  termination  is  the  key  to  any  suc- 
cessful first-stage  abort,  and  new  ideas  and 
technologies  should  be  examined.  If  a  thrust  ter- 
mination system  is  eventually  deemed  feasible 
(that  is.  the  Orbiter/External  Tank  will  still  be 
intact  after  the  rapid  deceleration),  it  cannot  have 
failure  modes  that  would  cause  an  uncommanded 
neutralization  of  the  thrust  of  one  or  both  of  the 
Solid  Rocket  Boosters.  If  thrust  termination  were 
to  be  implemented,  reliable  detection  mechanisms 
and  reliable  decision  criteria  would  be 
mandatory. 

Ditching 

As  previously  discussed,  most  contingency 
aborts  (those  resulting  from  failure  of  two  or  three 
main  engines  during  the  first  five  to  six  minutes 
of  flight)  result  in  a  water  landing,  or  ditching. 
In  addition,  if  the  Space  Shuttle  did  have  a  thrust 
termination  capability  to  use  with  fast-separation 
to  allow  it  to  separate  from  failing  solid  rockets, 
the  Orbiter  would  have  to  ditch  in  the  water 
unless  the  failure  occurred  during  a  small  win- 
dow 50-70  seconds  after  launch.  Accordingly, 
whether  the  crew  can  survive  a  water  impact  is 
a  critical  question. 

In  1974  and  1975,  ditching  studies  were  con- 
ducted at  Langley  Research  Center.  Although 
test  limitations  precluded  definitive  conclusions, 
the  studies  suggested  that  the  loads  at  water  im- 
pact would  be  high.  The  deceleration  would  most 
probably  cause  structural  failure  of  the  crew  cabin 
support  ties  to  the  fuselage,  which  would  impede 
crew  egress  and  possibly  flood  the  cabin.  Further- 
more, payloads  in  the  cargo  bay  are  not  designed 
to  withstand  decelerations  as  high  as  those  ex- 
pected,2 and  would  very  possibly  break  free  and 
travel  forward  to  the  crew  cabin.  The  Langley 
report  does  state  that  the  Orbiter  shape  and  mass 
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properties  are  good  for  ditching,  but  given  the 
structural  problems  and  deceleration  loads,  that 
is  little  consolation. 

Orbiter  ditching  was  discussed  by  the  Crew 
Safety  Panel  and  at  Orbiter  flight  techniques 
meetings  before  the  first  Shuttle  flight.  The  con- 
sensus of  these  groups  was  that  (1)  ditching  is 
more  hazardous  than  suggested  by  the  early 
Langley  tests,  and  (2)  ditching  is  probably  not 
survivable. 

This  view  was  reiterated  in  the  September  9, 
1982,  letter  from  Griffin  to  Abrahamson: 

"We  also  suggest  no  further  effort  be  ex- 
pended to  study  bailout  or  ditching.  There 
is  considerable  doubt  that  either  case  is 
technically  feasible  with  the  present  Orbiter 
design.  Even  if  a  technical  solution  can  be 
found,  the  impact  of  providing  either 
capability  is  so  severe  in  terms  of  cost  and 
schedule  as  to  make  them  impractical." 

There  is  no  evidence  that  a  Shuttle  crew  would 
survive  a  water  impact.  Since  all  contingency 
aborts  and  all  first  stage  abort  capabilities  that 
are  being  studied  culminate  in  a  water  impact, 
an  additional  provision  for  crew  escape  before  im- 
pact should  also  be  considered. 

Astronaut  Paul  VVeitz  expressed  this  before  the 
Commission  on  April  3,   1986: 

"My  feeling  is  so  strong  that  the  Orbiter 
will  not  survive  a  ditching,  and  that  includes 
land,  water  or  any  unprepared  surface.  .  .  . 

T  think  if  we  put  the  crew  in  a  position 
where  they're  going  to  be  asked  to  do  a  con- 
tingency  abort,  then  they  need  some  means 
to  get  out  of  the  vehicle  before  it  contacts 
earth,  the  surface  of  the  earth. "3 


Crew  Escape  Options 

In  a  study  conducted  before  the  Orbiter  con- 
tract was  awarded,  Rockwell  International 
evaluated  a  range  of  ejection  systems  (Rockwell 
International,  Incorporated,  Phase  B  Study. 
1971).  The  table  shows  the  results  comparing 
three  systems:  ejection  seats,  encapsulated  ejec- 
tion seats  and  a  separable  crew  compartment. 
The  development  costs  are  in  1971  dollars,  and 
the  costs  and  weights  cited  were  those  required 
to  incorporate  these  systems  into  the  developing 
Orbiter  design,  not  to  modify  an  existing  Orbiter. 

The  only  system  that  could  provide  protection 
for  more  than  the  two-man  experimental  flight 
crew  was  the  separable  crew  compartment,  which 
would  add  substantial  wreight  and  development 
cost.  All  of  these  systems  had  limitations  in  their 
ability  to  provide  successful  escape,  and  all  would 
require  advance  warning  of  an  impending  hazard 
from  reliable  data  sources. 

The  Request  for  Proposal,  written  in  April, 
1971  (reference  paragraph  1.3.6.2.1),  states:  "Pro- 
visions shall  be  made  for  rapid  emergency  egress 
of  the  crew  during  development  test  flights."  Ejec- 
tion seats  were  selected  as  the  emergency  escape 
system.  The  objective  was  to  offer  the  crew  some 
protection,  though  limited,  from  risks  of  the  test 
flights.  The  philosophy  was  that  after  the  test 
flights,  all  unknowns  would  be  resolved,  and  the 
vehicle  would  be  certified  for  "operational"  flights. 

Conventional  ejection  seats  similar  to  those  in- 
stalled in  the  Lockheed  F-12/SR-71  were  selected 
shortly  after  the  Orbiter  contract  was  awarded. 
They  were  subsequently  incorporated  into  Co- 
lumbia and  were  available  for  the  first  four  flights. 
The  ejection  could  be  initiated  by  either  crew 
member  and  would  be  used  in  the  event  of  un- 
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controlled  flight,  on-board  fire  or  pending  land- 
ings on  unprepared  surfaces.  The  escape  se- 
quence required  approximately  15  seconds  for  the 
crew  to  recognize  pending  disaster,  initiate  the 
sequence  and  get  a  safe  distance  away  from  the 
vehicle. 

Although  the  seats  were  originally  intended  for 
use  during  first -stage  ascent  or  during  gliding 
flight  below  100,000  feet,  analysis  showed  that 
the  crew  would  be  exposed  to  the  Solid  Rocket 
Booster  and  main  engine  exhaust  plumes  if  they 
ejected  during  ascent.  During  descent,  the  seats 
provided  good  protection  from  about  100,000  feet 
to  landing. 

After  the  Space  Shuttle  completed  the  four  test 
flights  it  was  certified  for  "operational"  flights.  But 
missions  for  the  "operational"  flights  required 
more  crew  members,  and  there  were  no  known 
ejection  systems,  other  than  an  entire  cabin 
escape  module,  that  could  remove  the  entire  crew 
within  the  necessary  time.  The  Orbiter  configura- 
tion allowed  room  for  only  two  ejection  seats  on 
the  flight  deck.  With  alternative  ejection  concepts 
and  redesign  of  the  flight  deck,  this  number  might 
have  been  increased  slightly,  but  not  to  the  full 
crew  size.  Thus,  because  of  limited  utility  dur^ 
ing  first- stage  ascent  ancT  inability  to  accom- 
modaTe"  a  UjIT  crew,  the  ejection  seats  were 
eliminated  foroperational  flights. 
'The  present  Shuttle  has  no  means  for  crew 
escape,  either  during  first-stage  ascent  or  during 
gliding  flight.  Conventional  ejection  seats  do  not 
appear  to  be  viable  Space  Shuttle  options  because 
they  severely  limit  the  crew  size  and,  therefore, 
prevent  the  Space  Shuttle  from  accomplishing  its 
mission  objectives.  The  remaining  options  fall  in- 
to three  categories: 

1 .  Escape  Module.  The  entire  crew  compart- 
ment would  be  separated  from  the  Orbiter 
and  descend  by  parachute. 

2.  Rocket-assisted  Extraction.  Many  military 
aircraft  employ  a  system  using  a  variety  oi 
small  rocket-assisted  devices  to  boost  oc- 
cupants from  the  plane.  Such  a  system 
could  be  used  in  the  Orbiter. 

3.  Bail-Out  System.  The  crew  can  exit 
unassisted  through  a  hatch  during  con- 
trolled, gliding  flight. 

Only  one  of  these,  the  escape  module,  offers 
the  possibility  of  escape  during  first-stage  ascent. 


Its  use  would  probably  be  practical  only  after 
thrust  termination.  It  should  be  noted  that  in  all 
cases  of  crew  escape,  the  Orbiter  would  be  lost, 
but  in  cases  of  Solid  Rocket  Booster  failure  or  Or- 
biter ditching  the  vehicle  would  be  lost  anyway. 
The  utility  and  feasibility  of  each  method  are 
described  below. 

An  escape  module  can  offer  an  opportunity  for 
crew  escape  at  all  altitudes  during  a  first-stage 
time-critical  emergency  if  the  escape  system  itself 
is  not  damaged  to  the  point  that  it  cannot  func- 
tion. The  module  must  be  sufficiently  far  from 
the  vehicle  at  the  time  of  catastrophe  that  neither 
it  nor  its  descent  system  is  destroyed.  Incorpora- 
tion of  an  escape  module  would  require  signifi- 
cant redesign  of  the  Orbiter:  some  structural  rein- 
forcement, pyrotechnic  devices  to  sever  the  escape 
module  from  the  rest  of  the  Orbiter,  modifica- 
tions to  sever  connections  that  supply  power  and 
fluids,  separation  rockets  and  a  parachute  system. 
An  additional  weight  penalty  would  result  from 
the  requirement  to  add  mass  in  the  rear  of  the 
Orbiter  to  compensate  for  the  forward  shift  in  the 
center  of  gravity.  Recent  estimates  indicate  this 
could  add  as  much  as  30,000  pounds  to  the  weight 
of  the  Orbiter.4  This  increase  in  weight  would 
reduce  payload  capacity  considerably,  perhaps 
unacceptably.  There  is  no  current  estimate  of  the 
attendant  cost. 

An  escape  module  does  theoretically  offer  the 
widest  range  of  crew  escape  options.  The  other 
two  options,  rocket  extraction  and  bail-out,  are 
only  practical  during  gliding  flight.  Both  methods 
would  be  useful  when  the  Orbiter  could  not  reach 
a  prepared  runway,  for  they  would  allow  the  crew 
to  escape  before  a  very  hazardous  landing  or  a 
water  ditching.  Aerodynamic  model  tests  showed 
that  a  crew  member  bailing  out  through  either 
the  side  or  overhead  hatch  would  subsequently 
contact  the  wing,  tail  or  orbital  maneuvering 
system  pod  unless  he  or  she  could  exit  with  suffi- 
cient velocity  (>  5  to  10  feet  per  second)  to  avoid 
these  obstacles.  Slides  and  pendant  rocket  systems 
were  evaluated  as  means  of  providing  this  veloci- 
ty, but  all  concepts  of  bail-out  and  rocket  extrac- 
tion that  were  studied  require  many  minutes  to 
get  the  entire  crew  out  and  would  be  practical 
only  during  controlled  gliding  flight.  The  results 
of  these  studies  were  presented  at  the  Program 
Requirements  Change  Board  session  held  on 
May  12,  1983,  and  subsequently  to  the  NASA 
administrator,  but  none  of  the  alternatives  was 
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implemented  because  of  limited  capability  and 
resulting  program  impacts. 

There  is  much  discussion  and  disagreement 
over  which  escape  systems  are  feasible,  or  whether 
any  provide  protection  against  a  significant 
number  of  failure  modes. 

The  astronauts  testifying  before  the  Commis- 
sion on  April  3,  1986,  agreed  that  it  does  not  ap- 
pear practical  to  modify  the  Orbiter  to  incor- 
porate an  escape  module.  The  astronauts  dis- 
agreed, however,  about  which  of  the  other  two 
systems  would  be  preferable.  As  Astronaut  Weitz 
testified: 

"John  [Astronaut  John  Young]  likes  the 
rocket  extraction  system  because  it  does 
cover  a  wider  flight  regime  and  allows  you 
to  get  out  perhaps  with  the  vehicle  only 
under  partial  control  as  opposed  to  complete 
control;  however,  any  system  that  adds  more 
parts  like  rockets  gets  more  complex.  .  .  . 
The  only  kind  of  a  system  that  I  think  is  even 
somehow  feasible  would  be  maybe  some 
kind  of  a  bail-out  system  that  could  be  used 
subsonic."5 

In  its  1982  Annual  Report,  the  Aerospace  Safe- 
ty Advisory  Panel  listed  "crew  escape  ...  at 
launch  and  prior  to  potential  ditching"6  as  a 
priority  item  that  warranted  further  study.  The 
Commission  fully  supports  such  studies.  In  par- 
ticular, the  Commission  believes  that  the  crew 
should  have  a  means  of  escaping  the  Orbiter  in 
controlled,  gliding  flight.  The  Commission  thinks 
it  crucial  that  the  vehicle  that  will  carry  astronauts 
into  orbit  through  this  decade  and  the  next  in- 
corporate systems  that  provide  some  chance  for 
crew  survival  in  emergencies.  It  nonetheless  ac- 
cepts the  following  point  made  by  Astronaut 
Robert  Crippen: 

"I  don't  know  of  an  escape  system  that 
would  have  saved  the  crew  from  the  par- 
ticular incident  that  we  just  went  through 
[the  Challenger  accident]."7 

Range  Safety 

Television  coverage  of  the  Challenger  accident 
vividly  showed  the  Solid  Rocket  Boosters  emerg- 
ing from  the  ball  of  fire  and  smoke.  The  erratic 
and  uncontrolled  powered  flight  of  such  large 
components  could  have  posed  a  potential  danger 
to  populated  areas.  The  responsible  official  ac- 
cordingly destroyed  the  Solid  Rocket  Boosters. 


To  understand  how  the  booster  rockets  were 
destroyed,  one  must  understand  the  purpose  of 
a  range  safety  system,  its  functions,  and  t he- 
special  considerations  that  apply  to  Shuttle- 
launches. 

The  Eastern  Space  and  Missile  Center  operates 
a  range  safety  system  for  all  Department  of 
Defense  and  NASA  launch  activities  in  the  Cape 
Canaveral  area.  The  primary  responsibility  of  the 
range  safety  system,  run  by  the  U.S.  Air  Force, 
is  to  protect  people  and  property  from  abnormal 
vehicle  flights  during  first  stage  ascent. 

To  fulfill  its  range  safety  responsibilities,  the 
Eastern  Space  and  Missile  Center  staff  supervises 
on-site  launch  preparations  and  tracks  rockets  and 
vehicles  until  they  are  far  enough  away  from 
populated  areas  to  remove  any  danger.  When 
such  a  danger  arises  during  the  ascent  stage  of 
a  launch,  the  vehicle  may  have  to  be  destroyed 
to  minimize  harm  to  persons  and  property  on  the 
ground.  Every  major  vehicle  flown  from  the  Cape 
Canaveral  area  has  carried  an  explosive  destruct 
system  that  could  be  armed  and  fired  by  the  range 
safety  officer. 

Range  safety  procedures  in  launch  activities 
from  Kennedy  are  governed  by  Department  of 
Defense  and  NASA  documents.  The  primary 
regulatory  publication  is  DOD  Document 
3200.11,  Use,  Management,  and  Operation  of 
DOD  Major  Ranges  and  Test  Facilities. 

Space  Shuttle  Range  Safety  System 

Both  Space  Shuttle  Solid  Rocket  Boosters  and 
the  External  Tank  are  fitted  with  explosive 
charges.  These  can  be  detonated  on  the  command 
of  the  range  safety  officer  if  the  vehicle  crosses 
the  limits  established  by  flight  analysis  before 
launch  and  the  vehicle  is  no  longer  in  controlled 
flight.  The  determination  of  controllability  is 
made  by  the  flight  director  in  Mission  Control, 
Houston,  who  is  in  communication  with  the 
range  safety  officer.  Following  an  encoded  "arm" 
command,  the  existing  package  on  the  Shuttle 
System  is  detonated  by  a  subsequent  encoded 
"fire"  command. 

The  range  safety  officer  who  sends  the  com- 
mands is  the  key  decision  maker  who  is  finally 
responsible  for  preventing  loss  of  life  and  property 
that  could  result  if  the  vehicle  or  components 
should  fall  in  populated  areas.  The  destruct 
criteria  are  agreed  to  by  NASA  and  the  Eastern 
Space  and  Missile  Center. 
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A  range  safety  system  for  the  Shuttle  launches 
was  approved  in  concept  in  1974.  Under  that  con- 
cept, the  capability  to  destroy  the  system  in  flight 

Range  Safety  System  Components 


Linear  Shaped  Charge 


Linear  Shaped  Charge 
SRB  Linear  Shaped  Charges 


Range  Safety 
Command  Antennas 


Drawing  shows  position  of  linear  shaped  charges  and  range 
safety  command  antennas  on  Solid  Rocket  Boosters  and  Ex- 
ternal Tank. 


from  the  ground  was  to  be  installed  in  the  form 
of  radio  detonated  explosive  charges  triggered  by 
encoded  signals.  Such  a  range  safety  package  ap- 
peared necessary  for  a  variety  of  reasons  based 
upon  the  initial  Shuttle  design  that  included  ejec- 
tion seats.  If  the  crew  were  to  eject,  the  unmanned 
vehicle  would  be  uncontrollable  and  thus  a  much 
greater  danger  than  a  manned  system. 

After  the  first  four  test  flights,  however,  the 
ejection  seats  were  deactivated.  Retaining  the 
range  safety  package  when  the  crew  could  no 
longer  escape  was  an  emotional  and  controver- 
sial decision.  In  retrospect,  however,  the 
Challenger  accident  has  demonstrated  the  need 
for  some  type  of  range  safety  measure.  Since  the 
current  range  safety  system  does  not  allow  for 
selective  destruction  of  components,  the  Commis- 
sion believes  that  NASA  and  the  Air  Force  should 
critically  re-examine  whether  the  destruct  package 
on  the  External  Tank  might  be  removed. 

Range  Safety  Activities,  January  28,   1986 

The  range  safety  officer  for  the  Challenger 
flight  on  January  28  was  Maj.  Gerald  F. 
Bieringer,  U.S.  Air  Force.  He  reported  that  the 
mission  was  normal  until  about  76  seconds  after 
launch.  The  following  description  is  from  Maj. 


Bieringer's  written  statement  prepared  approx- 
imately two  hours  after  the  accident: 

"Watching  the  IP  [impact  point]  displays 
and  optics  I  observed  the  primary  and  alter- 
nate sources  diverge  significantly  at  about 
T  +  76  [76  seconds  into  the  flight].  At  about 
the  same  time  I  heard  .  .  .  [through 
monitored  communications]  the  vehicle  had 
exploded.  Concurrently,  I  saw  the  explosion 
on  the  video  monitor  on  my  right.  A  white 
cloud  seemed  to  envelop  the  vehicle,  small 
pieces  exploded  out  of  it.  The  IP  displays 
PRI  and  ALT  indications  were  jumping 
around  wildly.  I  was  about  to  recommend 
we  do  nothing  as  it  appeared  the  entire  vehi- 
cle had  exploded  when  I  observed  what  ap- 
peared to  be  an  SRB  [Solid  Rocket  Booster] 
stabilized  and  flying  toward  the  upper  left 
corner  of  the  display.  As  it  appeared  stabil- 
ized I  felt  it  might  endanger  land  or  ship- 
ping and  as  the  ET  [External  Tank]  had  ap- 
parently exploded  I  recommended  to  the 
SRSO  [senior  range  safety  officer]  we  send 
functions.  I  sent  ARM,  waited  about  10 
seconds,  and  sent  FIRE.  .  .  .  FIRE  was  sent 
at  about  110  [seconds]."8 

During  the  flight  and  prior  to  the  accident, 
tracking  and  control  functions  performed  normal- 
ly. There  were  no  communications  problems 
throughout  the  range  or  with  the  NASA  flight 
dynamics  officer  in  Mission  Control,  Houston. 

Range  safety  data  displays  did  not  provide 
useful  information  immediately  after  the  accident. 
The  range  safety  officer  depended  upon  the  video 
displays  for  evidence  concerning  the  performance 
of  the  Solid  Rocket  Boosters.  Without  that  infor- 
mation, the  range  safety  officer  would  not  have 
sent  the  destruct  signals.  Detailed  studies  from 
Marshall  had  indicated  that  Solid  Rocket 
Boosters  would  tumble  if  prematurely  separated. 
That  assumption  made  possible  the  prediction  of 
impact  points.  When  the  Challenger  Solid  Rocket 
Boosters  separated  after  the  explosion,  however, 
they  continued  powered,  stabilized  flight  and  did 
not  tumble,  contrary  to  the  expectations  upon 
which  range  safety  rules  had  been  based.  Without 
the  live  television  pictures,  the  range  safety  of- 
ficer would  not  have  known  about  the  unexpected 
performance  of  the  boosters. 

The  Eastern  Space  and  Missile  Center  and 
NASA  have  appropriately  initiated  a  comprehen- 
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sive  review  ot  the  Shuttle  range  safety  re- 
quirements and  their  implementation.  The  events 
of  the  Challenger  accident  demonstrate  the  need 
for  a  range  safety  package  of  some  type  on  the 
Solid  Rocket  Boosters.  However,  the  review 
should  examine  whether  technology  exists  that 
would  allow  combining  the  range  safety  function 
for  the  Solid  Rocket  Boosters  with  a  thrust  ter- 
mination system,  and  whether,  if  technically 
feasible,  it  would  be  desirable. 

Postflight  Analysis 

The  Mission  Control  Center  in  Houston  had 
no  more  warning  of  the  impending  disaster  than 
the  range  safety  officer  had.  All  information  that 
might  be  useful  in  recognizing  problems  that  the 
crew  or  the  mission  control  flight  team  could  do 
something  about  is  available  to  flight  controllers 
during  the  launch,  but  that  information  con- 
stitutes only  a  fraction  of  the  electronic  data  being 
telemetered  from  the  Shuttle.  To  ensure  that 
nothing  was  overlooked  during  the  launch, 
Johnson  flight  controllers  conducted  a  thorough 
analysis  of  the  telemetry  data  on  January  29  and 
30,  1986. 

Their  review  of  the  recorded  events  revealed 
that  the  chamber  pressure  inside  the  right  Solid 
Rocket  Booster  began  to  differ  from  that  of  the 
left  booster  approximately  60  seconds  after  lift  off. 
A  sampling  of  that  information  is  available  to  a 
flight  controller  during  ascent,  but  the  internal 
pressures  of  the  boosters  are  normally  not 
monitored  during  the  first  stage.  The  readings 
are  used  only  to  indicate  whether  the  crew  can 
expect  an  on-time  or  slightly  delayed  separation 
of  the  boosters  from  the  Orbiter  and  External 
Tank.  The  difference  in  pressure  during  the  brief 
ascent  of  Challenger  was  small,  and  pressures 
were  within  acceptable  limits. 

The  replay  of  the  data  also  indicated  that  the 
vehicle  flight  control  system  was  responding  prop- 
erly  to  external  forces  and  continued  to  control 
the  Shuttle  until  the  accident.  No  unusual  mo- 
tion responses  occurred,  and  inside  the  cockpit 
then'  were  no  alarms.  There  are  no  indications 
that  the  crew  had  any  warning  of  a  problem 
before  the  fire  and  the  disintegration  of  the  Space 
Shuttle. 


Findings 

1 .  The  Space  Shuttle  System  was  not  designed 
to  survive  a  failure  of  the  Solid  Rocket  Boosters. 
There  are  no  corrective  actions  that  can  be  taken 
if  the  boosters  do  not  operate  properly  after 
ignition,  i.e.,  there  is  no  ability  to  separate  an 
Orbiter  safely  from  thrusting  boosters  and  no 
ability  for  the  crew  to  escape  the  vehicle  during 
first-stage  ascent. 

■  Neither  the  Mission  Control  Team  nor  the 
51-L  crew  had  any  warning  of  impending 
disaster. 

■  Even  if  there  had  been  warning,  there  were 
no  actions  available  to  the  crew  or  the  Mis- 
sion Control  Team  to  avert  the  disaster. 

Landing:  Another  Critical  Phase 

The  consequences  of  faulty  performance  in  any 
dynamic  and  demanding  flight  environment  can 
be  catastrophic.  The  Commission  was  concerned 
that  an  insufficient  safety  margin  may  have  ex- 
isted in  areas  other  than  Shuttle  ascent.  Entry  and 
landing  of  the  Shuttle  are  dynamic  and  demand- 
ing with  all  the  risks  and  complications  inherent 
in  flying  a  heavyweight  glider  with  a  very  steep 
glide  path.  Since  the  Shuttle  crew  cannot  divert 
to  any  alternate  landing  site  after  entry,  the  land- 
ing decision  must  be  both  timely  and  accurate. 
In  addition,  the  landing  gear,  which  includes 
wheels,  tires  and  brakes,  must  function  proper- 
ly. These  considerations  will  be  discussed  for  both 
normal  and  abort  landings. 

Abort  Site  Weather 

The  acceptability  of  the  weather  at  abort  land- 
ing sites,  both  inside  and  outside  the  continental 
United  States,  is  a  critical  factor  in  the  launch 
decision  process.  The  local  weather  minima  for 
the  actual  launch  are  necessarily  restrictive.  The 
minima  for  acceptably  safe  abort  landings  are 
even  more  restrictive.  Of  course,  the  wider  the 
range  of  acceptable  weather  conditions,  the 
greater  the  possibility  of  launch  on  any  given  day. 
As  a  result  of  past  efforts  to  increase  the  likelihood 
of  launch,  abort  landing  weather  criteria  are  cur- 
rently less  restrictive  than  the  criteria  for  planned 
landings. 

The  program  also  allows  consideration  of 
launching  with  a  light  rain  shower  over  the  Ken- 
nedy runway.  Although  engineering  assessments 
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indicate  that  the  tile  damage  that  would  result 
would  not  affect  Shuttle  controllability,  it  would 
be  a  serious  setback  to  the  program  in  terms  of 
budget  and  schedule.  This  rule  is  designed  to 
allow  the  program  to  weigh  the  probability  of  a 
return-to-launch-site  abort  and  decide  whether 
it  is  worthwhile  to  launch  and  accept  the  risk  of 
a  setback  because  of  tile  damage  should  a  return- 
to-launch-site  abort  be  required.  This  risk  appears 
to  be  unnecessary. 

The  programmatic  decision  to  accept  worse 
weather  for  an  abort  landing,  in  a  situation  where 
other  conditions  are  also  less  than  optimal,  is  not 
consistent  with  a  conservative  approach  to  flight 
safety.  The  desire  to  launch  is  understandable, 
and  abort  landings  are  indeed  improbable. 
However,  if  an  abort  is  required,  it  is  irrelevant 
that  it  was  unlikely.  An  emergency,  the  loss  of 
a  Space  Shuttle  Main  Engine,  has  already  oc- 
curred to  produce  the  necessity.  Abort  situations 
will  require  landing  under  emergency  conditions 
on  limited  runways  with  Orbiter  weights  higher 
than  normal.  The  difficulties  should  not  be 
compounded  by  high  crosswinds  or  reduced 
visibility.  The  Commission  recommended  that 
this  subject  be  reviewed,  and  those  reviews  are 
currently  underway. 

Orbiter  Tires  and  Brakes 

The  Aerospace  Safety  Advisory  Panel  has 
shared  NASA's  concern  over  the  Orbiter  wheels, 
tires  and  brakes  since  the  beginning  of  the  Shut- 
tle program.  This  is  summarized  in  its  1982  An- 
nual Report. 

"The  landing  gear  including  wheels,  tires, 
and  brakes  is  vital  for  safe  completion  of  any 
mission.  With  the  future  flights  going  to 
higher  weights  and  lower  margins,  possibly 
even  negative  margins,  it  is  imperative  that 
existing  capabilities  be  fully  explored, 
documented  and  improved  where 
necessary."9 

Orbiter  Tires 

Orbiter  tires  are  manufactured  by  B.F. 
Goodrich  and  are  designed  to  support  a  Space 
Shuttle  landing  up  to  240,000  pounds  at  225  knots 
with  20  knots  of  crosswind.  The  tires  have  a 
34-ply  rating  using  16  cords.  Though  they  have 
successfully  passed  testing  programs,  they  have 
shown  excessive  wear  during  landings  at  Ken- 
nedy, especially  when  crosswinds  were  involved. 


The  tires  are  rated  as  Criticality  1  because  loss 
of  a  single  tire  could  cause  loss  of  control  and 
subsequent  loss  of  vehicle  and  crew. 

Based  upon  approach  and  landing  test  ex- 
perience, crosswind  testing  was  added  to  the 
Space  Shuttle  tire  certification  testing.  To  date, 
Orbiters  have  landed  with  a  maximum  of  8  knots 
of  crosswind  at  the  Kennedy  runway  resulting  in 
heavy  tire  wear:  both  spinup  wear  that  occurs  ini- 
tially at  touchdown  and  crosswind  wear  induced 
by  side  forces  and  differential  braking.  While 
dynamometer  tests  indicated  that  these  tires 
should  withstand  conditions  well  above  the  design 
specification,  the  tests  have  not  been  able  to 
simulate  runway  surface  effects  accurately.  A 
Langley  Research  Center  test  track  has  been  used 
to  give  a  partial  simulation  of  the  strains  caused 
by  a  landing  at  Kennedy.  This  test  apparatus  will 
be  upgraded  for  further  testing  in  the  summer 
of  1986  in  an  attempt  to  include  all  the  repre- 
sentative flight  loads  and  conditions. 

The  tires  have  undergone  extensive  testing  to 
examine  effects  of  vacuum  exposure,  temperature 
extremes,  and  cuts.  They  also  have  undergone 
leakage,  side  force,  load,  storage,  and  durability 
tests.  The  tires  have  qualified  in  all  these  areas. 

To  date,  tests  using  the  simulated  Kennedy 
runway  at  Langley  indicate  that  spinup  wear  by 
itself  will  not  lead  to  tire  failure.  Tests  using  the 
Kennedy  test  surface  do  indicate  that  spinup  wear 
is  worse  if  the  tire  is  subjected  to  crosswind.  For 
this  reason,  the  crosswind  allowable  for  normal 
landings  is  limited  to  10  knots.  This  restriction 
also  permits  a  safe  stop  if  the  nosewheel  steering 
system  fails.  The  limitation  is  being  reviewed  to 
see  if  it  is  too  high  for  abort  landings  involving 
nosewheel  steering  failure.  Testing  has  not  been 
conducted  to  ensure  that  excessive  crosswind  wear 
will  not  be  a  hazard  when  landing  on  the  various 
hard  surface  runways  with  maximum  crosswinds 
and  failed  nosewheel  steering. 

Main  tire  loads  are  increased  substantially  after 
nosewheel  touchdown  because  of  the  large 
downward  wing  force  at  its  negative  angle  of  at- 
tack. The  total  force  on  each  side  can  be  nearly 
200,000  pounds,  which  exceeds  the  capability  of 
a  single  tire.  In  fact,  the  touchdown  loads  alone 
can  exceed  the  load  bearing  ability  of  a  single  tire. 
The  obvious  result  is  that  if  a  single  tire  fails 
before  nosegear  touchdown,  the  vehicle  will  have 
serious  if  not  catastroph  c  directional  control 
problems  following  the  ex  >ected  failure  of  the  ad- 
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jacent  tire.  This  failure  case  has  led  to  a  Critic  ulitv 
1  rating  on  the  tires.  Before  nosegear  touchdown, 
control  is  maintained  through  the  rudder. 
However,  it  loses  effectiveness  as  the  speedbrake 
is  opened  and  the  vehicle  decelerates.  After 
nosegear  touchdown,  simulations  have  shown 
that  directional  control  is  possible  using  the 
nosewheel  steering  system  for  most  subsequent 
failures,  but  not  for  some  cases  in  which 
crosswinds  exceed  the  current  flight  rule  limits. 
Because  of  the  consequences  of  this  failure,  crew 
members  strongly  recommend  that  the  nosewheel 
steering  system  be  modified  to  achieve  full 
redundancy. 

Tire  side  loads  have  been  difficult  to  measure 
and  subsequently  model  because  of  test  facility 
limitations.  Two  mathematical  models  were 
developed  from  early  dynamometer  tests  and  ex- 
trapolation from  nosewheel  tire  tests.  New- 
dynamic  tests  of  main  gear  tires  show  a  more  flex- 
ible side  response,  which  has  been  incorporated 
into  the  latest  mathematical  model.  A  reasonably 
accurate  model  is  required  both  for  nosewheel 
steering  engineering  studies  and  for  crew  train- 
ing simulators. 

The  Orbiter  tire  in  use  meets  specifications  and 
has  been  certified  through  testing.  However, 
testing  has  not  reproduced  results  observed  on 
Kennedy  runways.  To  date,  the  only  blown  tire 
has  been  caused  by  a  brake  lockup  and  the 
resulting  skid  wear. 

Several  improvements  have  been  considered  to 
increase  protection  against  the  high-speed  blown- 
tire  case.  One  would  add  a  skid  at  the  bottom 
of  the  main  gear  strut  to  take  the  peak  load  dur- 
ing nosegear  touchdown;  another  would  add  a 
roll-on-rim  capability  to  the  main  gear  wheel. 
None  of  the  possible  improvements  has  been 
funded,  however,  nor  has  any  been  seriously 
studied. 

In  summary,  two  blown  tires  before  nosegear 
touchdown  would  likely  be  catastrophic,  and  the 
potential  for  that  occurrence  should  be  mini- 
mized. NASA  has  directed  testing  in  the  fall  of 
1986  to  examine  actual  tire,  wheel,  and  strut 
failures  to  better  understand  this  failure  case. 

Orbiter  Brakes 

The  Orbiter  brake  design  chosen  in  1973  was 
based  on  the  Orbitcr's  design  weight.  It  used 
beryllium  rotors  and  stators  with  carbon  lining. 
However,  as  the  actual  Orbiter  weight  grew,  the 


response  from  the  Shuttle  program  management 
was  not  a  redesign  of  the  brakes,  but  an  exten- 
sion of  required  runway  length  from  10,000  to 
12,500  feet.  Thus,  the  brakes  for  many  years  have 
been  known  to  have  little  or  no  margin,  even  if 
they  performed  as  originally  designed. 

There  are  four  brake  assemblies,  one  for  each 
main  landing  gear  wheel.  Each  assembly  uses 
four  rotors  and  three  stators,  the  stators  being  at- 
tached to  a  torque  tube.  Carbon  pads  are  attached 
to  provide  the  friction  surface.  The  Orbiter  brakes 
were  designed  to  absorb  36.5  million  foot-pounds 
of  energy  for  normal  stops  and  55.5  million  foot- 
pounds of  energy  for  one  emergency  stop.  The 
brakes  were  tested  and  qualified  using  standard 
dynamometer  tests. 

Actual  flight  experience  has  shown  brake 
damage  on  most  flights.  The  damage  is  classified 
by  cause  as  either  dynamic  or  thermal.  The 
dynamic  damage  is  usually  characterized  by 
damage  to  rotors  and  carbon  lining  chipping,  plus 
beryllium  and  pad  retainer  cracks.  On  the  other 
hand,  the  thermal  damage  has  been  due  to 
heating  of  the  stator  caused  by  energy  absorp- 
tion during  braking.  The  beryllium  becomes  duc- 
tile and  has  a  much  reduced  yield  strength  at 
temperatures  possible  during  braking.  Both  types 
of  damage  are  typical  of  early  brake  development 
problems  experienced  in  the  aviation  industry. 

Brake  damage  has  required  that  special  crew 
procedures  be  developed  to  assure  successful 
braking.  To  minimize  dynamic  damage  and  to 
keep  any  loose  parts  together,  the  crews  are  told 
to  hold  the  brakes  on  constantly  from  the  time 
of  first  application  until  their  speed  slows  to  about 
40  knots.  For  a  normal  landing,  braking  is  ini- 
tiated at  about  130  knots.  For  abort  landings, 
braking  would  be  initiated  at  about  150  knots. 
Braking  speeds  are  established  to  avoid  exceeding 
the  temperature  limits  of  the  stator.  The  earlier 
the  brakes  are  applied,  the  higher  the  heat  rate. 
The  longer  the  brakes  are  applied,  the  higher  the 
temperature  will  be,  no  matter  what  the  heat  rate. 
To  minimize  problems,  the  commander  must  get 
the  brake  energy  into  the  brakes  at  just  the  right 
rate  and  just  the  right  time  — before  the  beryllium 
yields  and  causes  a  low-speed  wheel  lockup. 

At  a  Commission  hearing  on  April  3,  1986, 
Astronaut  John  Young  described  the  problem  the 
Shuttle  commander  has  with  the  system: 

"It  is  very  difficult  to  use  precisely  right 
now.  In  fact,  we're  finding  out  we  don't  real- 
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lv  have  a  good  technique  for  applying  the 
brakes.  .  .  .  We  don't  believe  that  astronauts 
or  pilots  should  be  able  to  break  the 
brakes."  10 

Missions  5.  51-D  and  61-C  had  forms  of  ther- 
mal stator  damage.  The  mission  51-D  case 
resulted  in  a  low-speed  wheel  lockup  and  a  subse- 
quent blown  tire  at  Kennedy.  The  mission  61-C 
case  did  not  progress  to  a  lockup  but  came  very 
close.  The  amount  of  brake  energy  that  can  be 
obtained  using  normal  braking  procedures  is 
about  40  million  foot-pounds  before  the  first  stator 
fails.  The  mission  61-C  damage  occurred  at  34 
million  foot-pounds  but  had  not  progressed  to  the 
lockup  condition.  Inspection  of  failed  stators 
clearly  shows  the  ductile  failure  response  of  the 
beryllium,  and.  hence,  it  appears  that  this  failure 
mechanism  cannot  contribute  to  a  high-speed 
lockup  and  subsequent  tire  failure.  It  should  be 
noted  that  the  brake  specification  called  for  a 
maximum  energy  of  55  million  foot-pounds. 
Qualification  testing  of  the  abort  braking  profile 
showed  that  55  million  foot-pounds  was  the  point 
of  first  stator  failure.  During  qualification  tests, 
the  brakes  continued  to  operate  until  all  stators 
failed,  providing  about  another  5  million  foot- 
pounds of  energy.  Based  upon  the  thermal 
response  of  beryllium  under  load,  it  appears  that 
the  early  heavy  braking  required  for  transatlan- 
tic abort  landings  produces  more  than  the  40 
million  foot-pounds  that  have  resulted  in  thermal 
failure  of  the  brakes  during  the  normal  braking 
profile.  No  numbers  are  certain,  however,  and 
clearly  the  qualification  testing  did  not  point  out 
the  current  thermal  problems. 

The  assumed  normal  and  abort  brake  energy 
limits  for  the  current  design  should  be 
reinvestigated.  The  61-C  damage  resulted  from 
only  34  million  foot-pounds  of  energy.  If  this 
same  brake  design  is  to  continue  to  fly,  the  mis- 
sion 61-C  damage  should  be  fully  understood, 
and  destructive  testing  should  be  accomplished 
to  establish  the  short  runway  (transatlantic  abort 
landing)  brake  limit  and  appropriate  abort  land- 
ing planning  factors. 

NASA  is  considering  stator  improvements,  in- 
cluding steel  or  thicker  beryllium  stators.  and  has 
undertaken  a  carbon  brake  program  that  would 
provide  a  major  margin  improvement  and  less 
dynamic  damage  because  of  fewer  parts.  Addi- 
tional testing  is  currently  underway,  and  more 
is  planned,  to  evaluate  these  brake  modifications 


and  to  perform  destructive  testing.  The  testing 
results  are  expected  to  conform  more  closely  to 
tlight  conditions  because  landing  gear  dynamics 
have  been  included.  Early  tests  have  confirmed 
the  energy  levels  for  the  abort  braking  profile  with 
a  modified  brake,  and  future  tests  may  provide 
confidence  in  the  normal  braking  profile. 

The  Aerospace  Safety  Advisory  Panel  recog- 
nized NASA's  efforts  in  its  1985  Annual  Report: 

"A  carbon  brake  review  was  conducted  by 
NASA  in  early  December.  1985.  and  re- 
sulted in  agreement  to  procure  a  carbon 
brake  system  for  the  Orbiter.  .  .  .  There  is 
concern  by  the  STS  [Space  Transportation 
System]  management  about  the  availabili- 
ty of  resources  to  support  the  development 
of  the  carbon  brakes  given  the  many  com- 
peting requirements  and  the  projected  con- 
strained budget  during  the  1986  period.  The 
program  management  considers  the  de- 
velopment of  the  carbon  brake  system  to  be 
of  the  highest  priority  .  .  .  and  the  Panel  sup- 
ports this  position  as  it  has  in  the  past."11 

Because  of  the  brake  problems  encountered  in 
the  program,  two  reviews  have  been  conducted 
by  NASA.  The  third  review  will  take  place  dur- 
ing the  summer  of  1986.  The  review  board 
members  have  studied  all  of  the  Orbiter  brake 
data  and  have  compared  Orbiter  problems  to  in- 
dustry problems.  Improvements  suggested  have 
been  implemented.  It  is  the  consensus  of  NASA 
and  industry  experts  that  high  priority  should  be 
placed  on  correcting  Orbiter  brake  problems,  and 
that  brake  redesign  should  proceed  with  emphasis 
on  developing  higher  energy  and  torque  capacity. 

Concern  within  the  program  about  the  entire 
deceleration  system  (landing  gear,  wheels,  tires, 
brakes  and  nosewheel  steering)  has  been  the  sub- 
ject of  numerous  reviews,  meetings  and  design 
efforts.  These  concerns  continued  to  be  expressed 
by  the  Aerospace  Safety  Advisory  Panel  in  1982: 

"Studies  of  Shuttle  landings  to  date  show 
that  tire,  wheel  and  brake  stresses  are  ap- 
proaching limits."  12 

"Short  runways,  with  inadequate  over- 
runs, are  cause  for  concern,  for  instance,  a 
transatlantic  abort  to  Dakar."13 

The  issues  are  difficult,  and  the  required 
technology  is  challenging,  but  most  agree  that  it 
is  appropriate  and  important  that  NASA  resolve 
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each  of  these  problems.  A  conservative  approach 
to  the  landing  phase  of  flight  demands  reliable 
performance  by  all  critical  systems. 

Kennedy  Space  Center  Landings 

The  original  Space  Shuttle  plan  called  for 
routine  landings  at  Kennedy  to  minimize  turn- 
around time  and  cost  per  flight  and  to  provide 
an  efficient  operation  for  both  the  Shuttle  system 
and  the  cargo  elements.  While  those  considera- 
tions remain  important,  other  concerns,  such  as 
the  performance  of  the  Orbiter  tires  and  brakes, 
and  the  difficulty  of  accurate  weather  prediction 
in  Florida,  have  called  the  plan  into  question. 

When  the  Shuttle  lands  at  Edwards  Air  Force 
Base,  California,  approximately  six  days  are 
added  to  the  turnaround  time  compared  with  a 
landing  at  Kennedy.  That  is  the  time  required 
to  load  the  Orbiter  atop  the  Shuttle  carrier  air- 
craft, a  specially  modified  Boeing  747,  and  to 
ferry  it  back  to  Florida  for  processing. 

Returning  the  Orbiter  to  Kennedy  from  Ed- 
wards costs  not  only  time  but  also  money:  near- 
ly $1 ,000,000,  not  including  the  cost  of  additional 
ground  support  equipment,  extra  security  and 
other  support  requirements.  Further,  the  people 
necessary  to  accomplish  the  turnaround  tasks 
must  be  drawn  from  the  staffs  at  Kennedy  and 
Vandenberg  Air  Force  Base,  California.  They  are 
the  same  people  needed  for  the  preparation  for 
subsequent  flights. 

Returning  the  Orbiter  also  imposes  an  addi- 
tional handling  risk  to  the  vehicle  in  both  the 
loading  operation  and  the  ferry  flight  itself.  En- 
countering light  precipitation  during  the  ferry 
flight  has  caused  substantial  damage  to  the  Or- 
biter thermal  protection  system.  These  costs  and 
risks,  however,  are  minimal  when  compared  with 
those  of  a  Space  Shuttle  mission. 

The  Kennedy  runway  was  built  to  Space  Shut- 
tle design  requirements  that  exceeded  all  Federal 
Aviation  Administration  requirements  and  was 
coordinated  extensively  with  the  Air  Force, 
Dryden  Flight  Research  Center,  NASA  Head- 
quarters, Johnson,  Kennedy,  Marshall  and  the 
Army  Corps  of  Engineers.  The  result  is  a  single 
concrete  runway,  15,000  feet  long  and  300  feet 
wide.  The  grooved  and  coarse  brushed  surface 
and  the  high  coefficient  of  friction  provide  an  all- 
weather  landing  facility. 

The  Kennedy  runway  easily  meets  the  intent 
of  most  of  the  Air  Force,  Federal  Aviation  Ad- 


ministration and  International  Civil  Aviation 
Organization  specification  requirements.  Accord- 
ing to  NASA,  it  was  the  best  runway  that  the 
world  knew  how  to  build  when  the  final  design 
was  determined  in  1973. 

In  the  past  several  years,  questions  about 
weather  predictability  and  Shuttle  systems  per- 
formance have  influenced  the  Kennedy  landing 
issue.  Experience  gained  in  the  24  Shuttle  land- 
ings has  raised  concerns  about  the  adequacy  of 
the  Shuttle  landing  and  rollout  systems:  tires, 
brakes  and  nosewheel  steering.  Tires  and  brakes 
have  been  discussed  earlier.  The  tires  have  shown 
excessive  wear  after  Kennedy  landings,  where  the 
rough  runway  is  particularly  hard  on  tires.  Tire 
wear  became  a  serious  concern  after  the  landing 
of  mission  51-D  at  Kennedy.  Spinup  wear  was 
three  cords  deep,  crosswind  wear  (in  only  an 
8-knot  crosswind)  was  significant  and  one  tire 
eventually  failed  as  a  result  of  brake  lock-up  and 
skid. 

This  excessive  wear,  coupled  with  brake 
failure,  led  NASA  to  schedule  subsequent  land- 
ings at  Edwards  while  attempting  to  solve  these 
problems.  At  the  Commission  hearing  on  April 
3,  1986,  Clifford  Charlesworth,  director  of  Space 
Operations  at  Johnson,  stated  his  reaction  to  the 
blown-tire  incident: 

"Let  me  say  that  following  51-D  .  .  .  one 
of  the  first  things  I  did  was  go  talk  to  then 
program  manager,  Mr.  Lunney,  and  say  we 
don't  want  to  try  that  again  until  we  under- 
stand that,  which  he  completely  agreed  with, 
and  we  launched  into  this  nosewheel  steer- 
ing development."14 

There  followed  minor  improvements  to  the 
braking  system.  The  nosewheel  steering  system 
was  also  improved,  so  that  it,  rather  than  differen- 
tial braking,  could  be  used  for  directional  con- 
trol to  reduce  tire  wear. 

These  improvements  were  made  before  mis- 
sion 61-C,  and  it  was  deemed  safe  for  that  mis- 
sion and  subsequent  missions  to  land  at  Kennedy. 
Bad  weather  in  Florida  required  that  61-C  land 
at  Edwards.  There  were  again  problems  with  the 
brakes,  indicating  that  the  Shuttle  braking  system 
was  still  suspect.  Mr.  Charlesworth  provided  this 
assessment  to  the  Commission: 

"Given  the  problem  that  has  come  up  now 
with  the  brakes,  I  think  that  whole  question 
still  needs  some  more  work  before  I  would 
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be  satisfied  that  yes,  we  should  go  back  and 
try  to  land  at  the  Cape."15 

The  nosewheel  steering,  regarded  as  fail-safe, 
might  better  be  described  as  fail-passive:  at  worst, 
a  single  failure  will  cause  the  nosewheel  to  castor. 
Thus,  a  single  failure  in  nosewheel  steering, 
coupled  with  failure  conditions  that  require  its 
use,  could  result  in  departure  from  the  runway. 
There  is  a  long-range  program  to  improve  the 
nosewheel  steering  so  that  a  single  failure  will 
leave  the  system  operational. 

Eight  flights  have  been  launched  with  plans  to 
land  in  Florida.  Of  those,  three  have  been 
diverted  to  California  because  of  bad  weather. 
Moreover,  it  is  indicative  of  the  dynamic  weather 
environment  in  Florida  that  twice  in  the  pro- 
gram's history  flights  have  been  waved  off  for  one 
orbit  to  allow  for  weather  conditions  to  improve 
enough  to  be  acceptable  for  landing.  Thus,  even 
if  NASA  eventually  were  to  resume  routine 
operations  at  Kennedy,  experience  indicates  the 
Orbiter  will  divert  into  Edwards  more  than  30 
percent  of  the  time.  NASA  must  therefore  plan 
to  use  Edwards  routinely.  This  requires  reserv- 
ing six  days  in  the  post-landing  processing 
schedule  for  the  Orbiter's  ferry  trip  back  to 
Florida.  It  also  requires  redundancy  in  the  ferry 
aircraft.  The  single  Shuttle  carrier  aircraft,  with 
some  one-of-a-kind  support  items,  is  presently  the 
only  way  to  get  the  Orbiter  from  California  back 
to  its  launch  site  in  Florida. 
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The  most  serious  concern  is  not  that  the 
weather  in  Florida  is  bad,  but  that  the  at- 
mospheric conditions  are  frequently  unpre- 
dictable. Captain  Robert  Crippen  testified  before 
the  Commission  on  April  3,  1986: 

"I  don't  think  the  astronaut  office  would 
disagree  with  the  premise  that  you  are  much 
safer  landing  at  Edwards.  There  are  some 
things  you  could  do,  as  was  indicated,  to 
make   Kennedy   better,    but   you're   never 


going    to    overcome    the    weather    unpre- 
dictability."16 

Once  the  Shuttle  performs  the  deorbit  burn, 
it  is  going  to  land  approximately  60  minutes  later; 
there  is  no  way  to  return  to  orbit,  and  there  is 
no  option  to  select  another  landing  site.  This 
means  that  the  weather  forecaster  must  analyze 
the  landing  site  weather  nearly  one  and  one-half 
hours  in  advance  of  landing,  and  that  the  forecast 
must  be  accurate.  Unfortunately,  the  Florida 
weather  is  particularly  difficult  to  forecast  at  cer- 
tain times  of  the  year.  In  the  spring  and  summer, 
thunderstorms  build  and  dissipate  quickly  and 
unpredictably.  Early  morning  fog  also  is  very  dif- 
ficult to  predict  if  the  forecast  must  be  made  in 
the  hour  before  sunrise. 

In  contrast,  the  stable  weather  patterns  at  Ed- 
wards make  the  forecaster's  job  much  easier. 

Although  NASA  has  a  conservative  philos- 
ophy, and  applies  conservative  flight  rules  in 
evaluating  end-of-mission  weather,  the  decision 
always  comes  down  to  evaluating  a  weather 
forecast.  There  is  a  risk  associated  with  that.  If 
the  program  requirements  put  forecasters  in  the 
position  of  predicting  weather  when  weather  is 
unpredictable,  it  is  only  a  matter  of  time  before 
the  crew  is  allowed  to  leave  orbit  and  arrive  in 
Florida  to  find  thunderstorms  or  rapidly  form- 
ing ground  fog.  Either  could  be  disastrous. 

The  weather  at  Edwards,  of  course,  is  not 
always  acceptable  for  landing  either.  In  fact,  only 
days  prior  to  the  launch  of  STS-3,  NASA  was 
forced  to  shift  the  normal  landing  site  from 
Edwards  to  Northrup  Strip,  New  Mexico, 
because  of  flooding  of  the  Edwards  lakebed.  This 
points  out  the  need  to  support  fully  both  Ken- 
nedy and  Edwards  as  potential  end-of-mission 
landing  sites. 

In  summary,  although  there  are  valid  program- 
matic reasons  to  land  routinely  at  Kennedy,  there 
are  concerns  that  suggest  that  this  is  not 
wise  under  the  present  circumstances.  While 
planned  landings  at  Edwards  carry  a  cost  in  dollars 
and  days,  the  realities  of  weather  cannot  be 
ignored.  Shuttle  program  officials  must  recognize 
that  Edwards  is  a  permanent,  essential  part  of  the 
program.  The  cost  associated  with  regular, 
scheduled  landing  and  turnaround  operations  at 
Edwards  is  thus  a  necessary  program  cost. 

Decisions  governing  Space  Shuttle  operations 
must  be  consistent  with  the  philosophy  that  un- 
necessary risks  have  to  be  eliminated.  Such  deci- 
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sii  >ns  cannot  be  made  without  a  clear  understand- 
ing of  margins  of  safety  in  each  part  of  the  system. 
Unfortunately,   margins  of  safet)   cannot  be 
assured  if  performance  characteristics  are  not 

thoroughly  understood,  nor  can  they  be  deduced 
from  a  previous  flight's  "success." 

The  Shuttle  Program  cannot  afford  to  operate 
outside  its  experience  in  the  areas  of  tires,  brakes. 
and  weather,  with  the  capabilities  of  the  system 
today.  Pending  a  clear  understanding  of  all  land- 
ing and  deceleration  systems,  and  a  resolution  of 
the  problems  encountered  to  date  in  Shuttle  land- 
ings, the  most  conservative  course  must  be  fol- 
lowed in  order  to  minimize  risk  during  this 
dynamic  phase  of  flight. 

Shuttle  Elements 

The  Space  Shuttle  Main  Engine  teams  at  Mar- 
shall and  Rocketdyne  have  developed  engines  that 
have  achieved  their  performance  goals  and  have 
performed  extremely  well.  Nevertheless  the  main 
engines  continue  to  be  highly  complex  and  critical 
components  of  the  Shuttle  that  involve  an  element 
of  risk  principally  because  important  components 
of  the  engines  degrade  more  rapidly  with  flight 
use  than  anticipated.  Both  NASA  and  Rocket- 
dyne  have  taken  steps  to  contain  that  risk.  An 
important  aspect  of  the  main  engine  program  has 
been  the  extensive  "hot  fire"  ground  tests.  Un- 
fortunately, the  vitality  of  the  test  program  has 
been  reduced  because  of  budgetary  constraints. 

The  ability  of  the  engine  to  achieve  its  pro- 
gramed design  life  is  verified  by  two  test 
engines.  These  "fleet  leader"  engines  are  test  fired 
with  sufficient  frequency  that  they  have  twice  as 
much  operational  experience  as  any  flight  engine. 
Fleet  leader  tests  have  demonstrated  that  most 
engine  <  omponents  have  an  equivalent  40-llight 
service  life.  As  part  of  the  engine  test  program. 
major  (  omponents  are  inspected  periodically  and 
replaced  if  wear  or  damage  warrants.  Fleet 
leader  tests  have  established  that  the  low-pressure 
fuel  turbopump  and  the  low-pressure  oxidizer 
pump  have  lives  limited  to  the  equivalent  of  28 
and  22  flights,  respectively.  The  high-pressure 
fuel  turbopump  is  limited  to  six  flights  before 
overhaul;  tin-  high-pressure  oxidizer  pump  is 
limited  to  less  than  six  flights.17  An  active  pro- 
gram of  flight  engine  inspection  and  component 
replacement  has  been  effe<  lively  implemented  i>\ 


Rocketdyne.  based  on  the  results  of  the  fleet 
leader  engine  test  program. 

The  life-limiting  items  on  the  high-pressure 
pumps  are  the  turbine  blades,  impellers,  seals  and 
bearings.  Rocketdyne  has  identified  cracked  tur- 
bine blades  in  the  high -pressure  pumps  as  a 
primary  concern.  The  contractor  has  been  work- 
ing to  improve  the  pumps'  reliability  by  increas- 
ing bearing  and  turbine  blade  life  and  improv- 
ing dynamic  stability.  While  considerable 
progress  has  been  made,  the  desired  level  of 
turbine  blade  life  has  not  yet  been  achieved.  A 
number  of  improvements  achieved  as  a  result  of 
the  fleet  leader  program  are  now  ready  for  in- 
corporation in  the  Space  Shuttle  Main  Engines 
used  in  future  flights,  but  have  not  been  im- 
plemented due  to  fiscal  constraints.18  Immediate 
implementation  of  these  improvements  would 
allow  incorporation  before  the  next  Shuttle  flight. 

The  number  of  engine  test  firings  per  month 
has  decreased  over  the  past  two  years.  Yet  this 
test  program  has  not  yet  demonstrated  the  limits 
of  engine  operation  parameters  or  included  tests 
over  the  full  operating  envelope  to  show  full 
engine  capability.  In  addition,  tests  have  not  yet 
been  deliberately  conducted  to  the  point  of  failure 
to  determine  actual  engine  operating  margins. 

The  Orbiter  has  also  performed  well.  There 
is.  however,  one  serious  potential  failure  mode 
related  to  the  disconnect  valves  between  the  Or- 
biter and  the  External  Tank.  The  present  design 
includes  two  17-inch  diameter  valves,  one  con- 
trolling the  oxygen  flow,  and  the  other  the 
hydrogen  flow  from  the  tank  to  the  Orbiter's  three 
engines.  Each  of  the  disconnect  valves  has  two 
flappers  that  close  off  the  flow  of  the  liquid 
hydrogen  and  oxygen  when  the  External  Tank 
separates  from  the  Orbiter.  An  inadvertent 
closure  by  any  of  the  four  flappers  during  nor- 
mal engine  operation  would  cause  a  catastrophe 
due  to  rupture  of  the  supply  line  and/or  tank. 
New  designs  are  under  stuck',  incorporating 
modifications  to  prevent  inadvertent  valve 
closures.  Redesigned  valves  could  be  qualified, 
certified  and  available  for  use  on  the  Shuttle's  next 
flight. 

\\  hile  the  External  lank  has  performed  flaw- 
lessly during  all  Shuttle  flights,  one  area  of  con- 
(  era  pertains  to  the  indicators  for  the  two  valves 
which  vent  the  liquid  hydrogen  and  liquid  oxy- 
gen. These  valves  can  indicate  they  are  closed 
when  they  might  be  partially  open.    This  concli- 
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tion  is  potentially  hazardous,  since  leaks  of  either 
gaseous  oxygen  or  hydrogen  prior  to  launch,  or 
in  flight,  could  lead  to  fires.  This  could,  in  turn, 
lead  to  catastrophic  failure  of  the  External  Tank. 
NASA  is  currently  studying  design  modifications 
to  the  valve  position  indicators.  This  effort  could 
be  expedited  and  the  redesigned  indicators  in- 
stalled before  the  next  flight  of  the  Shuttle. 


Processing  and  Assembly 

During  the  processing  and  assembly  of  the 
elements  of  flight  51-L,  various  problems  were 
seen  in  the  Commission's  review  which  could  bear 
on  the  safety  of  future  flights. 

Structural  Inspections 

During  the  51-L  processing,  waivers  were 
granted  on  60  of  146  required  Orbiter  structural 
inspections.  Seven  of  these  waivers  were  second- 
time  waivers  of  inspections. 

A  formal  structural  inspection  plan  for  the 
Shuttle  fleet  had  not  been  fully  developed,  and 
not  all  of  the  146  inspections  had  been  scheduled 
for  the  51-L  processing.  In  order  to  minimize  the 
flight  delay  until  the  implementation  plan  could 
be  fully  developed,  the  waivers  were  documented, 
requested  and  granted  by  Level  II  at  Johnson. 

The  structural  inspection  requirements  are 
relatively  new  and  not  completely  mature.  A 
working  group  was  formed  in  December  1985, 
to  expedite  a  structural  inspection  plan.  A  plan 
now  exists  for  future  structural  inspections.  The 
Commission  believes  that  these  inspections  should 
not  be  waived.  The  fleet  of  Orbiters  has  no  coun- 
terpart anywhere  in  the  world.  There  is  no  data 
base  relative  to  reusable  spacecraft.  The  Orbiter's 
operating  environment  is  totally  different  from 
that  of  airliners,  and  the  program  must  closely 
track  the  effects  of  the  Orbiters'  age  and  use.19 

Records 

Throughout  the  Commission's  review  of  the  ac- 
cident, a  large  number  of  errors  were  noted  in 
the  paperwork  for  the  Space  Shuttle  Main 
Engine/Main  Propulsion  System  and  for  the  Or- 
biter. The  review  showed,  however,  that  in  the 
vast  majority  of  cases  the  problem  lay  in  the 
documentation  itself  and  not  in  the  work  that  was 
actually  accomplished.  The  review  led  the  Com- 
mission  to  conclude   that   the  Operations   and 


Maintenance  Instructions  are  in  need  of  an 
overall  review  and  update,  and  the  performance 
of  Operations  and  Maintenance  Instructions 
needs  to  be  improved. 

Missed  Requirements 

At  the  time  of  launch,  all  items  called  for  by 
the  Operational  Maintenance  Requirements  and 
Specifications  Document  were  to  have  been  met, 
waived  or  excepted.  The  51-L  audit  review  has 
revealed  additional  areas  where  such  re- 
quirements were  not  met  and  were  not  formally 
waived  or  excepted: 

1 .  A  formal  post-flight  inspection  of  the  for- 
ward External  Tank  attach  plate  was  not 
documented. 

2.  A  forward  avionics  bay  closeout  panel  was 
not  verified  as  installed  during  Orbiter 
rollover/stacking  operations  (the  area  was 
properly  configured  prior  to  flight  with  in- 
stallation of  a  locker). 

3.  Flight  51-L  was  launched  with  only  one  of 
two  crew  hatch  microswitches  showing  the 
proper  indication.  This  condition  was 
documented  by  a  Problem  Report  and  was 
deferred;  no  waiver  was  obtained,  however. 

4.  Post-flight  hydraulic  reservoir  sampling  was 
not  performed  prior  to  connection  of 
ground  hydraulic  support  equipment  at 
Dryden  Flight  Research  Facility,  but  was 
performed  in  the  Orbiter  Processing 
Facility. 

5.  During  Auxiliary  Power  Unit  hypergolic 
loading  operations,  the  Number  2  tank 
evacuation  prior  to  loading  was  not  main- 
tained above  20  inches  of  mercury  for  five 
minutes  as  required  (19.8  inches  main- 
tained for  2  hours).  This  incident  was 
documented  as  an  acceptable  condition  by 
Kennedy,  Johnson  and  Launch  Support 
Service,  but  no  waiver  was  submitted. 

6.  Landing  gear  voids  were  not  replenished 
and  crew  module  meters  were  not  verified 
during  final  vehicle  closeouts.  The  addi- 
tional requirement  to  replenish  the  landing 
gear  voids  during  launch  countdown  was 
performed.20 

Inspection  by  Proxy 

Another  aspect  of  the  processing  activities  that 
warrants  particular  attention  is  the  Shuttle  Proc- 
essing Contractor's  policy  of  using  "designated 
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verifiers"  to  supplement  the  quality  assurance 
force.  A  designated  verifier  is  a  senior  technician 
who  is  authorized  to  inspect  and  approve  his  own 
and  his  fellow  technicians'  work  in  specific  non- 
flight  areas,  instead  of  NASA  quality  assurance 
personnel  inspecting  the  work.  The  aviation  in- 
dustry follows  this  practice  in  performing  verifica- 
tions for  the  Federal  Aviation  Administration. 
The  Shuttle  Processing  Contractor  has  about  770 
designated  verifiers  (nearly  15%  of  the  work 
force).21  The  NASA  quality  assurance  inspection 
program  no  longer  covers  100  percent  of  the  in- 
spection areas.  Due  to  reduced  manpower, 
NASA  personnel  now  inspect  only  areas  that  are 
considered  more  critical.  Thus  the  system  of  in- 
dependent checks  that  NASA  maintained  through 
several  programs  is  declining  in  effectiveness.  The 
effect  of  this  change  requires  careful  evaluation 
by  NASA. 

Accidental  Damage  Reporting 

While  not  specifically  related  to  the  Challenger 
accident,  a  serious  problem  was  identified  dur- 
ing interviews  of  technicians  who  work  on  the  Or- 
biter.  It  had  been  their  understanding  at  one  time 
that  employees  would  not  be  disciplined  for  ac- 
cidental damage  done  to  the  Orbiter,  provided 
the  damage  was  fully  reported  when  it  occurred. 
It  was  their  opinion  that  this  forgiveness  policy 
was  no  longer  being  followed  by  the  Shuttle  Proc- 
essing Contractor.  They  cited  examples  of 
employees  being  punished  after  acknowledging 
they  had  accidentally  caused  damage.  The  techni- 
cians said  that  accidental  damage  is  not  con- 
sistently reported,  when  it  occurs,  because  of  lack 
of  confidence  in  management's  forgiveness  policy 
and  technicians'  consequent  fear  of  losing  their 
jobs.  This  situation  has  obvious  severe  implica- 
tions if  left  uncorrected. 


Launch  Pad  39B 

All  launch  damage  and  launch  measurement 
data  from  Pad  B  ground  systems  anomalies  were 
considered  to  be  normal  or  minor  with  three  ex- 
ceptions: the  loss  of  the  springs  and  plungers  on 
the  booster  hold-down  posts;  the  failure  of  the 
gaseous  hydrogen  vent  arm  to  latch;  and  the  loss 
of  bricks  from  the  flame  trench.  These  three  items 
are  treated  in  Appendix  I,  the  NASA  Pre-Launch 
Activities  Team  Report  (May,  1986).  None  con- 
tributed to  the  accident. 


Loss  of  bricks  from  the  flame  trench  was  also 
experienced  during  the  launch  of  STS-1  (April. 
1981)  and  STS-2  (November,  1981)  from  Pad  A, 
though  at  locations  closer  to  the  centerline  of  the 
vehicle.  Since  the  brick  was  blown  out  of  the 
flame  trench  and  away  from  the  vehicle,  there  is 
no  evidence  to  indicate  that  the  loose  brick  might 
have  endangered  the  51-L  vehicle,  but  it  may  be 
possible  for  damage  to  occur  if  the  condition  re- 
mains uncorrected.  The  Pad  B  fire  brick  is  to  be 
replaced  by  refractory  concrete,  as  was  done  on 
Pad  A. 


Involvement  of  Development 
Contractors 

The  Space  Shuttle  program,  like  its 
predecessors  Mercury,  Gemini,  Apollo,  Skylab 
and  Apollo-Soyuz,  is  clearly  a  developmental  pro- 
gram and  must  be  treated  as  such  by  NASA.  In- 
deed, the  chief  differences  between  the  Shuttle 
and  previous  developmental  programs  are  that 
the  Shuttle  is  principally  a  transportation  system 
and  employs  reusable  hardware.  Reusability  im- 
plies a  new  set  of  functions  such  as  logistics  sup- 
port, maintenance,  refurbishment,  lifetime  con- 
cerns and  structural  inspections  that  must  be 
addressed  by  the  program. 

In  order  to  enhance  post-flight  "turnaround" 
schedule  and  efficiency,  NASA  is  striving  to  im- 
plement processing  procedures  accepted  by  the 
transportation  industry.  While  this  effort  is  useful, 
there  is  not  an  exact  industry  analogy  to  the  Or- 
biter vehicles'  flight  operations,  because  each 
successive  Shuttle  mission  expands  system  and 
performance  requirements.  Consequently,  the 
Shuttle  configuration  is  evolving  as  design 
changes  and  improvements  are  incorporated.  The 
demands  of  individual  payloads  can  cause  signifi- 
cant additional  developmental  changes. 

These  developmental  aspects  make  significant 
demands,  which  can  be  met  only  by  the  follow- 
ing strategies: 

1 .  Maintain  a  significant  engineering  design 
and  development  capability  among  the 
Shuttle  contractors  and  an  ongoing  engi- 
neering capability  within  NASA. 

2.  Maintain  an  active  analytical  capability 
so  that  the  evolving  capabilities  of  the 
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Shuttle  can  be  matched  to  the  demands 
on  the  Shuttle. 

The  Shuttle's  developmental  status  demands  that 
both  NASA  and  all  its  contractors  maintain  a 
high  level  of  in-house  experience  and  technical 
ability. 

All  Shuttle  contractors  and  their  corresponding 
NASA  project  organizations  expressed  concern 
about  the  organization  of  contractor  services. 
When  Shuttle  operations  were  begun,  the  prime 
development  contractors  had  total  responsibility 
for  all  Shuttle  activities.  The  concept  of  a  single 
Shuttle  Processing  Prime  Contractor  was  adopted 
as  NASA  policy  in  1981,  and  implemented  in 
1983  when  a  team  led  by  Lockheed  Space  Opera- 
tions was  selected.  The  Lockheed  team  includes 
Lockheed  Missiles  &  Space  Company,  respon- 
sible for  processing  the  Orbiter;  Grumman  Aero- 
space Corporation,  responsible  for  operation  and 
maintenance  of  the  launch  processing  system; 
Pan  American  World  Airways,  charged  with  in- 
troducing and  maintaining  airline  methods  and 
techniques  in  the  processing  system;  Morton 
Thiokol,  Inc.,  responsible  for  processing  the  Solid 
Rocket  Boosters  and  External  Tank;  and  Rocket- 
dyne,  responsible  for  processing  the  Shuttle  main 
engines. 

Lockheed's  performance  as  Shuttle  Processing 
Contractor  is  judged  on  the  basis  of  a  NASA 
grading  system  using  agreed  criteria.  In 
September,  1984,  the  company  was  marked  down 
for  failure  to  form  a  coordinated  contractor  team. 
As  a  result  of  that  grading,  Lockheed  earned  for 
that  period  an  award  fee  of  about  one-quarter  of 
one  percent  of  cost,  on  a  maximum  fee  scale  at 
that  time  of  one  percent  of  cost.  Lockheed  re- 
viewed the  findings  of  NASA's  grading  and  did 
not  quarrel  with  its  major  thrust. 

The  award  fee  presently  is  a  composite  of  in- 
centives to  be  earned  on  mission  success  and  cost 
control.  It  can  vary  along  a  scale  of  one  to  14  per- 
cent of  cost.  The  Shuttle  Processing  Contractor 
was  earning,  at  the  time  of  the  Challenger  acci- 
dent, about  six  percent  of  cost,  or  nearly  mid- 
point on  the  scale. 

Although  the  performance  of  the  Shuttle  Proc- 
essing Contractor's  team  has  improved  con- 
siderably, serious  processing  problems  have  oc- 
curred, especially  with  respect  to  the  Orbiter.  An 
example  is  provided  by  the  handling  of  the  critical 
17-inch  disconnect  valves  during  the  51-L  flight 
preparations. 


During  External  Tank  propellant  loading  in 
preparation  for  launch,  the  liquid  hydrogen 
17-inch  disconnect  valve  was  opened  prior  to 
reducing  the  pressure  in  the  Orbiter  liquid 
hydrogen  manifold,  through  a  procedural  error 
by  the  console  operator.  The  valve  was  opened 
with  a  six  pounds  per  square  inch  differential. 
This  was  contrary  to  the  critical  requirement  that 
the  differential  be  no  greater  than  one  pound  per 
square  inch.  This  pressure  held  the  valve  closed 
for  approximately  18  seconds  before  it  finally 
slammed  open  abruptly.  These  valves  are  ex- 
tremely critical  and  have  very  stringent  tolerances 
to  preclude  inadvertent  closure  of  the  valve  dur- 
ing mainstage  thrusting.  Accidental  closing  of  a 
disconnect  valve  would  mean  catastrophic  loss  of 
Orbiter  and  crew.  The  slamming  of  this  valve 
(which  could  have  damaged  it)  was  not  reported 
by  the  operator  and  was  not  discovered  until  the 
post-accident  data  review.  Although  this  incident 
did  not  contribute  to  the  51-L  incident,  this  type 
of  error  cannot  be  tolerated  in  future  operations, 
and  a  policy  of  rigorous  reporting  of  anomalies 
in  processing  must  be  strictly  enforced. 

During  the  pre-launch  processing  and  post- 
flight  refurbishment  of  the  Orbiter,  Rockwell  — 
the  development  contractor  — acts  largely  as  an 
adviser  to  the  Shuttle  Processing  Contractor. 
Martin  Marietta  has  a  similar  role  regarding  the 
pre-launch  processing  of  the  External  Tank.  In 
contrast,  NASA  directed  the  Shuttle  Processing 
Contractor  to  subcontract  with  Rocketdyne  and 
Thiokol  for  the  processing  and  refurbishment  of 
the  main  engines  and  the  Solid  Rocket  Motors, 
respectively.  If  Rockwell  and  Martin  Marietta, 
as  the  development  contractor,  had  a  similar 
direct  involvement  with  their  elements  of  the 
Shuttle  system,  the  likelihood  of  difficulties  caused 
by  improper  processing  would  probably  be  de- 
creased. Furthermore,  all  Shuttle  elements  would 
benefit  from  the  advantages  of  beginning-to-end 
responsibility  vested  in  individual  contractors, 
each  responsible  for  the  design,  development, 
manufacturing,  operation,  and  refurbishment  of 
their  respective  Shuttle  elements. 
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Recommendations 


The  Commission  has  conducted  an  ex- 
tensive investigation  of  the  Challen- 
ger accident  to  determine  the  prob- 
able cause  and  necessary  corrective 
actions.  Based  on  the  findings  and  determinations 
of  its  investigation,  the  Commission  has 
unanimously  adopted  recommendations  to  help 
assure  the  return  to  safe  flight. 


The  Commission  urges  that  the  Administrator 
of  NASA  submit,  one  year  from  now,  a  report 
to  the  President  on  the  progress  that  NASA  has 
made  in  effecting  the  Commission's  recommen- 
dations set  forth  below: 


I 


Design.  The  faulty  Solid  RockexJ^Jtoxj-oint-and 
seal  must  be  changed.  This  could  be  a  new  design 
eliminating  the  joint  or  a  redesign  jpf  the  current 
joint  and  seal.  No  design  options  should  be 
prematurely  precluded  because  of  schedule,  cost 
or  reliance  on  existing  hardware.  All  Solid  Rocket 
Motor  joints  should  satisfy  the  following 
requirements: 

■  The  joints  should  be  fully  understood,  tested 
and  verified. 

■  The  integrity  of  the  structure  and  of  the  seals 
of  all  joints  should  be  not  less  than  that  of  the 
case  walls  throughout  the  design  envelope. 

■  The  integrity  of  the  joints  should  be  insensitive 
to: 

—  Dimensional  tolerances. 

—  Transportation  and  handling. 

—  Assembly  procedures. 

—  Inspection  and  test  procedures. 

—  Environmental  effects. 

—  Internal  case  operating  pressure. 

—  Recovery  and  reuse  effects. 

—  Flight  and  water  impact  loads. 


■  The  certification  of  the  new  design  should 
include: 

—  Tests  which  duplicate^thej.ctual  launch  con- 
figuration  as  closely  as  possible. 

—  Tests  over  the  full  range  of  operating  con- 
ditions, including  temperature. 

■  Full  consideration  should  be  given  to  conduct- 
ing static  firings  of  the  exact  flight  configura- 
tion in  a  vertical  attitude. 

Independent  Oversight.  The  Administrator  of 
NASA  should  request  the  National  Research 
Council  to  form  an  independent  Solid  Rocket 
Motor  design  oversight  committee  to  implement 
the  Commission's  design  recommendations  and 
oversee  the  design  effort.  This  committee  should: 

■  Review  and  evaluate  certification  require- 
ments. 

■  Provide  technical  oversight  of  the  design,  test 
program   and  certification. 

■  Report  to  the  Administrator  of  NASA  on  [In- 
adequacy of  the  design  and  make  appropriate 
recommendations. 
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II 


Shuttle  Management  Structure.  The  Shuttle 
Program  Structure  should  be  reviewed.  The  proj- 
ect managers  for  the  various  elements  of  the  Shut- 
tle program  felt  more  accountable  to  their  center 
management  than  to  the  Shuttle  program  organi- 
zation. Shuttle  element  funding,  work  package 
definition,  and  vital  program  information  fre- 
quently bypass  the  National  STS  (Shuttle)  Pro- 
gram Manager. 

A  redefinition  of  the  Program  Managers  respon- 
sibility is  essential.  This  redefinition  should  give 
the  Program  Manager  the  requisite  authority  for 
all  ongoing  STS  operations.  Program  funding 
and  all  Shuttle  Program  work  at  the  centers 
should  be  placed  clearly  under  the  Program 
Manager's  authority. 

Astronauts  in  Management.  The  Commission 
observes  that  there  appears  to  be  a  departure  from 
the  philosophy  of  the  1960s  and  1970s  relating 


to  the  use  of  astronauts  in  management  positions. 
These  individuals  brought  to  their  positions  flight 
experience  and  a  keen  appreciation  of  operations 
and  flight  safety. 

■  NASA  should  encourage  the  transition  of 
qualified  astronauts  into  agency  management 
positions. 

■  The  function  of  the  Flight  Crew  Operations 
director  should  be  elevated  in  the  NASA  orga- 
nization structure. 

Shuttle  Safety  Panel.  NASA  should  establish  an 
STS  Safety  Advisory  Panel  reporting  to  the  STS 
Program  Manager.  The  charter  of  this  panel 
should  include  Shuttle  operational  issues,  launch 
commit  criteria,  flight  rules,  flight  readiness  and 
risk  management.  The  panel  should  include 
representation  from  the  safety  organization,  mis- 
sion operations,  and  the  astronaut  office. 


Ill 


Criticality    Review    and    Hazard    Analysis. 

NASA  and  the  primary  Shuttle  contractors 
should  review  all  Criticality  1,  1R,  2,  and  2R 
items  and  hazard  analyses.  This  review  should 


to  flight  to  ensure  mission  success  and  flight  safe- 
ty. An  Audit  Panel,  appointed  by  the  National 
Research  Council,  should  verify  the  adequacy  of 
the  effort  and  report  directly  to  the  Administrator 


identify  those  items  that  must  be  improved  prior       of  NASA. 


IV 


Safety  Organization.  NASA  should  establish  an 
Office  of  Safety,  Reliability  and  Quality 
Assurance  to  be  headed  by  an  Associate  Ad- 
ministrator, reporting  directly  to  the  NASA  Ad- 
ministrator. It  would  have  direct  authority  for 
safety,  reliability,  and  quality  assurance 
throughout  the  agency.  The  office  should  be 
assigned  the  work  force  to  ensure  adequate  over- 
sight of  its  functions  and  should  be  independent 
of  other  NASA  functional  and  program 
responsibilities. 


The  responsibilities  of  this  office  should  include: 

■  The  safety,  reliability  and  quality  assurance 
functions  as  they  relate  to  all  NASA  activities 
and  programs. 

■  Direction  of  reporting  and  documentation  of 
problems,  problem  resolution  and  trends 
associated  with  flight  safety. 


199 


V 


Improved  Communications.  The  Commission 
found  that  Marshall  Space  Flight  Center  project 
managers,  because  of  a  tendency  at  Marshall  to 
management  isolation,  failed  to  provide  full  and 
timely  information  bearing  on  the  safety  of  flight 
51-L  to  other  vital  elements  of  Shuttle  program 
management. 

■  NASA  should  take  energetic  steps  to  eliminate 
this  tendency  at  Marshall  Space  Flight  Center, 
whether  by  changes  of  personnel,  organiza- 
tion, indoctrination  or  all  three. 


A  policy  should  be  developed  which  governs 
the  imposition  and  removal  of  Shuttle  launch 
constraints. 

Flight  Readiness  Reviews  and  Mission 
Management  Team  meetings  should  be 
recorded. 

The  flight  crew  commander,  or  a  designated 
representative,  should  attend  the  Flight 
Readiness  Review,  participate  in  acceptance 
of  the  vehicle  for  flight,  and  certify  that  the 
crew  is  properly  prepared  for  flight. 


VI 


Landing  Safety.  NASA  must  take  actions  to  im- 
prove landing  safety. 

■  Thejirej,  r^ake^md^nQse3YJae^el^sie£rin^^y^t£m_s 
_mmt_bgjmp_roved .  These  systems  do  not  have 

sufficient  safety  margin,  particularly  at  abort 
landing  sites. 

■  The  specific  conditions  under  which  planned 
landings  at  Kennedy  would  be  acceptable 
should  be  determined.  Criteria  must  be 
established  for  tires,  brakes  and  nosewheel 
steering.  Until  the  systems  meet  those  criteria 
in  high  fidelity  testing  that  is  verified  at 
Edwards,  landing  at  Kennedy  should  not  be 
planned. 


Committing  to  a  specific  landing  site  requires 
that  landing  area  weather  be  forecast  more 
than  an  hour  in  advance.  During  unpredict- 
able weather  periods  at  Kennedy,  program  of- 
ficials should  plan  on  Edwards  landings.  In- 
creased landings  at  Edwards  may  necessitate 
a  dual  ferry  capability. 


VII 


Launch  Abort  and  Crew  Escape.  The  Shuttle 
program  management  considered  first-stage  abort 
options  and  crew  escape  options  several  times 
during  the  history  of  the  program,  but  because 
of  limited  utility,  technical  infeasibility,  or  pro- 
gram cost  and  schedule,  no  systems  were  im- 
plemented. The  Commission  recommends  that 
NASA: 


M_ake_all  effojrt^to__provide  _a_crew  escape 
svstem  for  use  during  controlled  gliding  flight. 

Make  every  effort  to  increase  the  range  of  flight 
conditions  under  which  an  emergency  runway 
landing  can  be  successfully  conducted  in  the 
event  that  two  or  three  main  engines  fail  early 
in  ascent. 
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VIII 


Flight  Rate.  The  nation's  reliance  on  the  Shut- 
tle as  its  principal  space  launch  capability  created 
a  relentless  pressure  on  NASA  to  increase  the 
flight  rate.  Such  reliance  on  a  single  launch 
capability  should  be  avoided  in  the  future. 


NASA  must  establish  a  flight  rate  that  is  consis- 
tent with  its  resources.  A  firm  payload  assignment 
policy  should  be  established.  The  policy  should 
include  rigorous  controls  on  cargo  manifest 
changes  to  limit  the  pressures  such  changes  exert 
on  schedules  and  crew  training. 


IX 


Maintenance  Safeguards.  Installation,  test,  and 
maintenance  procedures  must  be  especially 
rigorous  for  Space  Shuttle  items  designated 
Criticality  1.  NASA  should  establish  a  system  of 
analyzing  and  reporting  performance  trends  of 
such  items. 

Maintenance  procedures  for  such  items  should 
be  specified  in  the  Critical  Items  List,  especially 
for  those  such  as  the  liquid-fueled  main  engines, 
which  require  unstinting  maintenance  and 
overhaul. 


With  regard  to  the  Orbiters,  NASA  should: 
■   Develop     and     execute     a    comprehensive 


jTiaintenance  inspection  pjarn. 

Perform  periodic  structural  inspections  when 
scheduled  and  not  permit  them  to  be  waived. 

Restore  and  support  the  maintenance  and 
spare  parts  programs,  and  stop  the  practice  of 
removing  parts  from  one  Orbiter  to  supply 
another. 


Concluding  Thought 


The  Commission  urges  that  NASA  continue  to  receive 
the  support  of  the  Administration  and  the  nation.  The 
agency  constitutes  a  national  resource  that  plays  a  critical 
role  in  space  exploration  and  development.  It  also  pro- 
vides a  symbol  of  national  pride  and  technological 
leadership. 


The  Commission  applauds  NASA  's  spectacular  achieve- 
ments of  the  past  and  anticipates  impressive  achievements 
to  come.  The  findings  and  recommendations  presented  in 
this  report  are  intended  to  contribute  to  the  future  NASA 
successes  that  the  nation  both  expects  and  requires  as  the 
21st  century  approaches.  ■ 
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Appendix  A 

Commission  Activities 


An  Overview 


President  Reagan,  seeking  to  ensure  a 
thorough  and  unbiased  investigation  of  the 
Challenger  accident,  announced  the  formation  of 
the  Commission  on  February  3,  1986.  The  man- 
date given  by  the  President,  contained  in 
Executive  Order  12546,  required  Commission 
members  to: 


(1)  Review  the  circumstances  surrounding  the 
accident  to  establish  the  probable  cause  or 
causes  of  the  accident;  and 

(2)  Develop  recommendations  for  corrective 
or  other  action  based  upon  the  Commis- 
sion's findings  and  determinations. 

Following  their  swearing  in  by  Chairman 
Rogers  on  February  6th,  Commission  members 
immediately  began  a  series  of  hearings  during 
which  NASA  officials  outlined  agency  procedures 
covering  the  Shuttle  program  and  the  status  of 
NASA's  investigation  of  the  accident. 

Shortly  thereafter,  on  February  10th,  Dr.  Alton 
G.  Keel,  Jr.,  Associate  Director  of  the  Of- 
fice of  Management  and  Budget,  was  appointed 
Executive  Director.  Dr.  Keel  began  gathering  a 
staff  of  15  experienced  investigators  from  various 
government  agencies  and  the  military  services, 
and  administrative  personnel  to  support  Commis- 
sion activities. 

During  a  closed  session  on  February  10,  1986, 
the  Commission  began  to  learn  of  the  troubled 
history  of  the  Solid  Rocket  Motor  joint  and  seals. 
Moreover,  it  discovered  the  first  indication  that 
the  contractor,  Morton  Thiokol,  initially  recom- 
mended against  launch  on  January  27,  1986,  the 
night  before  the  launch  of  51-L,  because  of  con- 


cerns regarding  low  temperature  effects  on  the 
joint  and  seal.  To  investigate  this  disturbing 
development,  additional  closed  sessions  were 
scheduled  for  February  13th  and  14th  at  Ken- 
nedy. The  February  13,  1986,  session  was  an  ex- 
tensive presentation  of  film,  video  and  telemetry 
data  relating  to  the  Challenger  accident.  It  pro- 
vided the  Commission  the  first  evidence  that  the 
Solid  Rocket  Motor  joint  and  seal  may  have 
malfunctioned,  initiating  the  accident. 

The  session  on  February  14th  included 
NASA  and  contractor  participants  involved  in  the 
discussion  on  January  27,  1986,  not  to  launch 
51-L.  After  testimony  was  received,  an  executive 
session  of  the  Commission  was  convened.  The 
following  statement  was  subsequently  issued  by 
the  Chairman  on  February  15,  1986,  reflecting 
the  conclusion  and  view  of  the  Commission: 

"In  recent  days,  the  Commission  has  been 
investigating  all  aspects  of  the  decision 
making  process  leading  up  to  the  launch  of 
the  Challenger  and  has  found  that  the  proc- 
ess may  have  been  flawed.  The  President  has 
been  so  advised. 

"Dr.  William  Graham,  Acting  Adminis- 
trator of  NASA,  has  been  asked  not  to  in- 
clude on  the  internal  investigating  teams  at 
NASA,  persons  involved  in  that  process. 

"The  Commission  will,  of  course,  continue 
its  investigation  and  will  make  a  full  report 
to  the  President  within  120  days." 

The  role  of  the  Commissioners  thus  changed 
from  that  of  overseers  to  that  of  active  in- 
vestigators and  analysts  of  data  presented  by 
NASA  and  its  contractors. 


206 


The  Commission  itself  divided  into  four  in- 
vestigative panels: 

1.  Development  and  Production,  responsi- 
ble for  investigating  the  acquisition  and 
test  and  evaluation  processes  for  the 
Space  Shuttle  elements; 

2.  Pre-Launch  Activities,  responsible  for 
assessing  the  Shuttle  system  processing, 
launch  readiness  process  and  pre-launch 
security; 

3.  Mission  Planning  and  Operations, 
responsible  for  investigating  mission 
planning  and  operations,  schedule 
pressures  and  crew  safety  areas;  and 

4.  Accident  Analysis,  charged  with  analyz- 
ing the  accident  data  and  developing  both 
an  anomaly  tree  and  accident  scenarios. 

By  February  17th,  the  panel  organization  had 
been  finalized  and,  on  February  18th,  Chairman 
Rogers  described  the  Commission's  new  approach 
before  Congress.  Working  groups  were  sent  to 
Marshall,  Kennedy  and  Thiokol  to  analyze  data 
relating  to  the  accident  and  to  redirect  efforts. 
NASA's  investigation  was  also  reorganized  to 
reflect  the  structure  of  the  Commission's  panels. 

A  series  of  public  hearings  were  planned  on 
February  25th,  26th  and  27th  to  assure  an  orderly 
and  fair  presentation  of  all  the  facts  that  the  Com- 
mission had  discovered  concerning  the  launch 
decision  making  process  for  flight  51-L.  At  these 
hearings,  additional  information  about  the  launch 
decision  was  obtained  from  the  testimony  of 
Thiokol,  Rockwell  and  NASA  officials.  Details 
about  the  history  of  problems  with  the  then 
suspect  Solid  Rocket  Motor  joints  and  seals  also 
began  emerging  and  served  to  focus  the  Commis- 
sion's attention  on  a  need  to  document  fully  the 
extent  of  knowledge  and  awareness  about  the 
problems  within  both  Thiokol  and  NASA. 

Following  these  hearings,  a  substantial  portion 
of  the  investigative  efforts  of  the  Commission  was 
conducted  by  the  separate  panels  in  parallel  with 
full  Commission  hearings. 

The  Accident  Analysis  Panel,  chaired  by  Ma- 
jor General  Donald  Kutyna,  made  several  trips 
to  both  Kennedy  and  Marshall  and  traveled  to 
Thiokol  facilities  in  Utah  to  review  photographic 
and  telemetric  evidence  as  well  as  the  results  of 
the  salvage  operation  and  to  oversee  the  tests  be- 
ing conducted  by  NASA  and  Thiokol  engineers. 

The  Accident  Analysis  Panel  followed  stand- 
ard investigative  procedures.  An  extensive  effort 


was  needed  to  establish  the  design,  manufactur- 
ing and  processing  baseline  configuration  of  the 
Shuttle  vehicle  for  STS  51-L.  A  data  base  was 
established  for  the  examination  and  analysis  of 
information  related  to  all  flight  elements  and 
segments.  From  these  data  and  a  compilation  of 
possible  and  observed  deviations  from  the  norm, 
scenarios  that  might  have  led  to  the  accident  were 
developed.  Tests  and  analyses  were  then  per- 
formed to  determine  the  specific  scenarios  most 
likely  to  have  caused  loss  of  Challenger. 

Early  in  March,  at  the  request  of  the  Chair- 
man, this  group  assembled  and  directed  the  Com- 
mission's independent  team  of  technical  observers 
with  extensive  experience  in  Solid  Rocket  Motor 
technology  and  accident  investigation  to  validate 
and  interpret  the  tests  and  analyses  performed  on 
the  Thiokol  motor  by  NASA  and  Thiokol. 

The  Development  and  Production  Panel, 
chaired  by  Joseph  Sutter,  centered  its  investiga- 
tion on  the  production  and  testing  activities  of 
the  Shuttle  element  contractors.  Starting  at 
Johnson,  the  panel  and  staff  investigators  looked 
at  how  these  contractors  and  their  NASA  counter- 
parts interact. 

They  next  traveled  to  the  Wasatch  plant  of 
Thiokol  in  Promontory,  Utah.  Thiokol  person- 
nel briefed  the  group  on  the  details  of  the  design, 
manufacturing,  verification  and  certification  of 
the  Solid  Rocket  Motors.  Similar  sessions  took 
place  in  April  in  Downey,  California,  at  the  head- 
quarters of  Rocketdyne,  Inc.,  the  Shuttle  main 
engine  contractor;  in  Canoga  Park,  California, 
at  the  facilities  of  Rockwell  International,  the  Or- 
biter  contractor;  in  Michoud,  Louisiana,  at  the 
plant  of  Martin  Marietta,  the  External  Tank  con- 
tractor; and  in  Berea,  Kentucky,  at  the  facilities 
of  Parker  Seal  Company,  the  manufacturers  of 
the  O-ring  seals  of  the  Thiokol  Solid  Rocket 
Motors. 

In  addition,  the  panel  traveled  to  Marshall  to 
learn  about  Marshall's  interaction  with  Thiokol 
and  to  discuss  issues  that  had  been  raised  during 
the  visits  to  the  contractors'  plants. 

The  Pre-Launch  Activities  Panel,  chaired  by 
David  Acheson,  centered  its  investigation  at  Ken- 
nedy where  the  Shuttle  elements  are  assembled 
and  all  other  final  launch  preparations  are  com- 
pleted. This  panel,  in  conjunction  with  the  Mis- 
sion Planning  and  Operations  Panel,  chaired  by 
Dr.  Sally  Ride,  met  with  its  NASA  counterparts 
in  early  March.  This  series  of  meetings  identified 
for  the  Commission  the  various  aspects  of  the  pre- 
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launch  process  that  required  thorough  review,  not 
only  for  the  purpose  of  the  Challenger  accident 
investigation  but  also  to  increase  safety  margins 
for  the  future. 

Later  in  March  the  Pre-Launch  Panel  again 
met  at  Kennedy  to  receive  the  NASA  Team's 
preliminary  reports  and  to  focus  on  the  spare 
parts  issue  and  Solid  Rocket  Booster  assembly 
operations.  Panel  members  also  met  with  contrac- 
tor personnel  involved  in  Shuttle  processing  and 
Kennedy  security  work. 

After  the  joint  meeting  at  Kennedy  with  the 
Pre-Launch  Activities  Panel,  the  Mission  Plan- 
ning and  Operations  Panel  traveled  to  Johnson 
to  begin  working  with  its  NASA  counterparts  and 
to  initiate  its  own  investigative  efforts.  A  specific 
focus  of  its  work  was  the  mission  planning  and 
crew  preparation  for  STS  51-L  and  details  of 
NASA's  safety,  reliability  and  quality  assurance 
programs.  Later  meetings  at  both  Johnson  and 
Marshall  dealt  with  range  safety,  weather  criteria 
for  launch,  flight  delays  and  hardware  testing. 

While  the  work  of  the  individual  panels  and 
their  investigative  staffs  was  ongoing,  a  general 
investigative  staff  began  a  series  of  individual  in- 
terviews to  document  fully  the  factual  background 
of  various  areas  of  the  Commission's  interest,  in- 
cluding the  telecon  between  NASA  and  Thiokol 
officials  the  night  before  the  launch;  the  history 
of  joint  design  and  O-ring  problems:  NASA  safe- 


ty, reliability  and  quality  assurance  functions;  and 
the  assembly  of  the  right  Solid  Rocket  Booster 
for  STS  51-L.  Subsequent  investigative  efforts  by 
this  group  were  directed  in  the  area  of  the  effec- 
tiveness of  NASA's  organizational  structure,  par- 
ticularly the  Shuttle  program  structure,  and 
allegations  that  there  had  been  external  pressure 
on  NASA  to  launch  on  Januarv  28th. 

More  than  160  individuals  were  interviewed 
and  more  than  35  formal  panel  investigative  ses- 
sions were  held  generating  almost  12.000  pages 
of  transcript  (Table  1  and  Table  2).  Almost  6,300 
documents,  totaling  more  than  122.000  pages, 
and  hundreds  of  photographs  were  examined  and 
made  a  part  of  the  Commission's  permanent  data 
base  and  archives.  These  sessions  and  all  the  data 
gathered  added  to  the  2.800  pages  of  hearing 
transcript  generated  by  the  Commission  in  both 
closed  and  open  sessions. 

In  addition  to  the  work  of  the  Commission  and 
the  Commission  staff,  NASA  personnel  expended 
a  vast  effort  in  the  investigation.  More  than  1,300 
employees  from  all  NASA  facilities  were  involved 
and  were  supported  by  more  than  1,600  people 
from  other  government  agencies  and  over  3,100 
from  NASA's  contractor  organizations.  Par- 
ticularly significant  were  the  activities  of  the 
military,  the  Coast  Guard  and  the  NTSB  in 
the  salvage  and  analysis  of  the  Shuttle  wreckage. 


Table  1 

Commission  Investigative  Interviews 


Interviews  of  January  27,  1986 
Teleconference  (8:15  PM  EST) 
Participants 

Ben  Powers  Jonn  Schell 

Frank  Adams  Keith  Coates 

Larry  Wear  George  Hardy 

James  Smith  Jud  Lovingood 

Boyd  Brinton  Jack  Buchanan 

Robert  Schwinghamer  Allan  McDonald 

William  Reihl  Carver  Kennedy 

Was  ric  Littles  Cecil  Houston 

John  Q.   Miller  Lawrence  Mulloy 

John  McCarty  Stanley  Reinartz 


William  Macbeth 
Brian  Russell 
Jack  Kapp 
Ron  Ebeling 
Calvin  Wiggins 
Larry  Saver 
Joel  Maw 
Kyle  Speas 
Jerry  Burn 
Don  Ketner 


Jerry  E.  Mason 
Robert  Lund 
Joseph  Kilminster 
Roger  Boisjoly 
Arnold  Thompson 
Jerry  Peoples 
James  Kingsbury 
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Interviews  of  Personnel 
Involved  in  Stacking  of 
of  Right  SRB  for  Flight  51-L 


Howard  Fichtl 
Jack  Roberts 
Curtis  J.  Newsome 
Mark  Vigil 
Bob  Heinbaugh 
Howard  Christy 
Jackie  Walden 
Alvie  Hicks 


Ed  O'Neal 
Leslie  Lake 
Buddy  Rogers 
Mario  Duran 
Jim  St.  John 
Billy  Massey 
Mike  Sieglitz 
Jim  Jordan 


Mike  Sestile 
Granville  Goad 
David  Mumpower 
Robin  Nix 
Glenn  Charron 
Stewart  Dalton 
Sharron  Whitaker 


Jim  Gardner 
John  Taris 
Kenneth  Koby 
Allen  R.  Hyde 
Jerry  Wilkerson 
Alex  McCool 
Charles  D.  Newman 


Interviews  on  Ice  on  Pad 

Thomas  Moser 
John  Peller 


Interviews  on  Security 

Marvin  Jones 
Herbert  Weisner 


Interviews  on  History  of  SRB 
Joint  Design  and  Problem 

Leon  Ray 
Alex  McCool 
Jerry  Peoples 
Glenn  Eudy 
Ben  Powers 
John  Miller 
Bill  Rice 
Bill  Horton 
Jerry  Cox 
Bill  Bush 
Paul  Wetzel 
David  Winterhalter 
William  Hamby 
Michael  Weeks 
Paul  Herr 


Robert  Lindstrom 
James  Brier 
Jesse  Moore 
Joseph  Kilminster 
Arnold  Thompson 
Irving  Davids 
Arnold  Aldrich 
Hans  Mark 
Glynn  Lunney 
Walt  C.  Williams 
George  Hardy 
Larry  Mulloy 
Fred  Uptagrafit 
Richard  Cook 
Walter  DankhofT 


James  Kingsbury 
Sam  Lowry 
Stanley  Reinartz 
Calvin  Wiggins 
Mark  Salita 
Joe  Pelham 
Phillip  Dykstera 
Ed  Dorsey 
Roger  Boisjoly 
Brian  Russel 
Jack  Kemp 
Robert  Lund 
Howard  Mcintosh 
Glenn  Eudy 
Robert  GafTin 


Ben  Powers 
Michael  Mann 
Richard  Kohrs 
Maurice  Parker 
Keith  Coates 
John  Schell 
James  W.  Thomas 
Boyd  Brinton 
James  Abrahamson 
Jerry  Mason 
Jack  Kapp 
Ronald  Ebeling 
Arnold  Aldrich 
Hazel  Saunders 


Interview  on  Launch  Coverage 
Camera  Failures 

Charles  Alsworth 


Interviews  on  Outside  Pressure 
To  Launch 

Michael  Weeks 
Jesse  Moore 
Charles  Kupperman 
Shirley  Green 
Vera  Herschberg 
Richard  Smith 


Phil  Culbertson 
George  Hardy 
Larry  Mulloy 
Joseph  Kilminster 
Stanley  Reinartz 
Robert  Lund 


Jerry  E.  Mason 
Arnold  Aldrich 
Lawrence  Wear 
John  Q.  Miller 
James  Smith 
Norman  Terrell 


Karen  Ehlers 
George  Johnson 
James  Beggs 
William  R.  Graham 
Richard  Cook 
Ben  Powers 
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Interviews  on  Safety,  Reliability  and  Quality  Assurance 

David  Brown  Jackie  C.  Walker  Howard  Gittens 

Richard  M.  Henritze  Benny  Nunnellv  Brian  Russell 

James  O.  Batte  George  Butler  Haggai  Cohen 

Arthur  M.  Carr  Henry  P.  Smith  Harry  Quong 

Wiley  C.  Bunn  Wesley  Hawkins  Dallas  N.  Vickers 

David  Austin  John  Maxson 


Wayne  Frazier 
Norman  R.  Schulze 
Stanley  Reinartz 
Milton  Silveira 


Interviews  on  Management  Structure 

Dick  Kohrs  James  Smith 

Jesse  Moore  Arnold  Aldrich 

Dr.  Hans  Mark  John  J.  McCarty 

William  Hamby  Scott  Simpkinson 

Michael  Weeks  James  Brier 

Lawrence  Wear  Jud  A.  Lovingood 

John  Q_.  Miller  Bill  Bush 
William  Lucas 


Jerry  Cox 

Jerry  Griffin 
Stanley  Reinartz 
James  Kingsbury 
Thomas  J.  Lee 
William  F.  Tavlor 


Richard  A.  Colonna 
Walt  C.  Williams 
George  Bridwell 
George  Johnson 
Richard  Cook 
Michael  Mann 


Interviews  on  Human  Factors 

Louis  E.  Toole  Jenny  Howard 

James  B.  Hill  Greg  Oliver 

Leonard  J.  Riche  Robert  Yackovetsky 

Heather  M.  Mitchell  Morton  O'Hare 


Ray  Hallard 

Ken  McCrary 

Joe  Kenneth  Patterson 


Gregory  Haywood  Williams 
Robert  L.  Brayant 
Keith  Coates 


Interview  on  Wreckage  Reconstruction 

Terrv  Armentrout 


Interview  on  Crew  Activities 
George  Abbey 
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Table  2 

Commission  Panel  Sessions 


Date 


Location 


Subject 


Accident  Analysis  Panel 


March  3,  4,  5 

Marshall 

March  6,  7 

Kennedy 

March  1 1 

Kennedy 

March  12,  13 

Marshall 

March  19 

Thiokol  —  Utah 

March  26 

Marshall 

April  10,  11 

Marshall 

April  14,  15,  1 

[6,  17 

Marshall 

Design,  Develop: 

ment  and  Production  Panel 

March  5 

Johnson 

March  17 

Thiokol  — Utah 

March  18 

Thiokol  — Utah 

April  2 

Rocketdyne  —  California 

April  3 

Rocketdyne  &  Rockwell  — California 

April  4 

Rockwell  —  California 

April  7 

Marshall 

April  8,9 

Martin  Marietta-Louisiana 

April  11 

Parker  Seal  — Kentucky 

Pre-Launch  Activities  Panel 

March  4,  5,  6  Kennedy 

March  17,   18,   19  Kennedy- 


Accident  Data  Review,  Fault  Tree  Analysis 
Film  &  Wreckage  Review 
Coordination  with  NASA  Task  Force 
Accident  Data  Review,  Fault  Tree  Analysis,  Test 

Requirements 
Test  Coordination 
Test  Review 
Test  Review 
Final  Review 


Preliminary  Briefing 

Fact-Finding  Session 

Design- Product  ion 

Main  Engines 

Development  —  Orbiter 

Orbiter 

Development  and  Production 

Development  —  External  Tank 

O-rings 


Training,  Workload,  Schedule,  Spares,  Pre-Launch 

Investigation  Update,  Security 
Manpower,  Spare  Parts,  Shuttle  Processing,  Security, 

Hold-down  Post  Spring  51-L,  Booster  Flow, 

Salvage  Status,  SRB  Recovery,  Launch  Readiness 

Process 


Mission  Planning  and  Operations  Panel 

March  4,  5  Kennedy 

March  11,   12  Johnson 


March  20 
March  24,  25 


April  7 
April  8,  9 

April   14,   15 


Johnson 
Johnson 


March  31,  April   1        Johnson 


Marshall 
Johnson 

[ohnson 


Preliminary  Briefing 

Crew  Activity    Planning,  Training,  Abort  Modes, 
Safety,  Manifesting 

Objectives  Review 

Range  Safety,  Mission  Operations,  Landing  Opera- 
tions, Weather,  Tile  Damage,  Main  Engines, 
Safety,  Reliability  and  Quality  Assurance 

Payload  Safety,  Hardware  Testing,  Training,  51-L 
Flight  Design 

Safety,  Reliability  and  Quality  Assurance 

Workload,  Software,  Manifesting,  Landing 
Considerations 

Ascent/Entry  Envelope,  Abort  Option  History, 
Safety,  Reliability  and  Quality  Assurance 
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Executive  Order  12546,  dated  February  3,  1986,  which  established 
the  Presidential  Commission  on  the  Space  Shuttle  Challenger  Accident 


EXECUTIVE  ORDER 


PRESIDENTIAL  COMMISSION  ON  THE 
SPACE  SHUTTLE  CHALLENGER  ACCIDENT 


By  the  authority  vested  in  me  as  President  by  the 
Constitution  and  statutes  of  the  United  States  of  America, 
including  the  Federal  Advisory  Committee  Act,  as  amended 
(5  U.S.C.  App.  I) ,  and  in  order  to  establish  a  commission  of 
distinguished  Americans  to  investigate  the  accident  to  the 
Space  Shuttle  Challenger,  it  is  hereby  ordered  as  follows: 

Section  1 .   Establishment .   (a)   There  is  established 
the  Presidential  Commission  on  the  Space  Shuttle  Challenger 
Accident.   The  Commission  shall  be  composed  of  not  more  than 
20  members  appointed  or  designated  by  the  President.   The 
members  shall  be  drawn  from  among  distinguished  leaders  of  the 
government,  and  the  scientific,  technical,  and  management 
communities. 

(b)   The  President  shall  designate  a  Chairman  and  a 
Vice  Chairman  from  among  the  members  of  the  Commission. 

Sec.  2.   Functions .   (a)   The  Commission  shall  investi- 
gate the  accident  to  the  Space  Shuttle  Challenger,  which 
occurred  on  January  28,  1986. 

(b)  The  Commission  shall: 

(1)  Review  the  circumstances  surrounding  the  accident 

to  establish  the  probable  cause  or  causes  of  the  accident;  and 

(2)  Develop  recommendations  for  corrective  or 
other  action  based  upon  the  Commission's  findings  and 
determinations. 

(c)  The  Commission  shall  submit  its  final  report  to  the 
President  and  the  Administrator  of  the  National  Aeronautics 
and  Space  Administration  within  one  hundred  and  twenty  days  of 
the  date  of  this  Order. 
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Sec.  3.   Administration.   (a)   The  heads  of  Executive 
departments  and  agencies  shall,  to  the  extent  permitted  by 
law,  provide  the  Commission  with  such  information  as  it  may 
require  for  purposes  of  carrying  out  its  functions. 

(b)  Members  of  the  Commission  shall  serve  without 
compensation  for  their  work  on  the  Commission.   However, 
members  appointed  from  among  private  citizens  of  the 
United  States  may  be  allowed  travel  expenses,  including 
per  diem  in  lieu  of  subsistence,  to  the  extent  permitted 

by  law  for  persons  serving  intermittently  in  the  government 
service  (5  U.S.C.  5701-5707). 

(c)  To  the  extent  permitted  by  law,  and  subject  to  the 
availability  of  appropriations,  the  Administrator  of  the 
National  Aeronautics  and  Space  Administration  shall  provide 
the  Commission  with  such  administrative  services,  funds, 
facilities,  staff,  and  other  support  services  as  may  be 
necessary  for  the  performance  of  its  functions. 

Sec.  4.   General  Provisions.   (a)   Notwithstanding  the 
provisions  of  any  other  Executive  Order,  the  functions  of 
the  President  under  the  Federal  Advisory  Committee  Act  which 
are  applicable  to  the  Commission,  except  that  of  reporting 
annually  to  the  Congress,  shall  be  performed  by  the  Adminis- 
trator of  the  National  Aeronautics  and  Space  Administration, 
in  accordance  with  guidelines  and  procedures  established  by 
the  Administrator  of  General  Services. 

(b)   The  Commission  shall  terminate  60  days  after 
submitting  its  final  report. 


THE  WHITE  HOUSE, 

February  3,  1986, 
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Appendix  B 


Commission 
Documentation  System 


Overview 


One  of  the  Commission's  initial  concerns  was 
to  make  certain  that  Commission  members  and 
staff  would  have  ready  access  to  the  tens  of 
thousands  of  pages  of  technical  information,  hear- 
ing transcripts,  witness  interviews,  and  cor- 
respondence relating  to  the  Challenger  accident. 
Several  aspects  of  the  investigation  made  gather- 
ing, controlling,  and  cataloging  such  information 
a  formidable  task.  One  was  the  massive  volume 
of  information  collected.  In  addition,  the  fairly 
short  response  time  required  of  the  Commission 
made  it  imperative  that  all  information  be  im- 
mediately and  completely  accessible.  Finally,  the 
Commission  needed  to  make  sure  that  it  could 
account  for  and  retrieve  every  piece  of  informa- 
tion that  it  collected  and  generated. 

To  address  those  issues,  the  Commission 
enlisted  the  support  of  the  Justice  Department's 
Office   of  Litigation   Support,    Civil   Division. 

With  existing  capabilities,  the  Office  of  Litiga- 
tion Support  mounted  a  rigorous  cataloging  ef- 
fort, developed  and  implemented  a  document 
control  system,  created  the  automated  data  bases, 
and  established  a  Commission  documents  Sup- 
port Center  for  document  processing  and  research 
activities. 

The  resulting  system  enabled  the  Commission 
to  manage  the  volume  and  assortment  of  infor- 
mation received  and  generated  in  the  course  of 
the  investigation,  and  provided  Commission  staff 
with  rapid  access  to  needed  information.  The 
system  was  designed  to  enable  access  to  either 
hard  copy  or  microfilm  for  future  research  after 
the  Commission  completed  its  work. 


The  Commission  was  able  to  meet  its  commit- 
ment to  ensuring  the  integrity  of  this  extensive 
collection  of  information;  all  information  pertain- 
ing to  the  investigation  can  be  easily  located  and 
its  origin  readily  traced. 

The  Commission  Information 
Management  System 

The  Commission  developed  procedures  to 
assure  that  it  received  all  documents  requested 
from  NASA  and  other  sources  and  that  all 
documents  and  other  correspondence  were  prop- 
erly processed. 

Document  Control 

The  Commission  had  control  procedures  and 
systems  to  track  all  types  of  documents  relevant 
to  the  investigation.  Specific  procedures  were 
used  to  process  (1)  Commission  requests  for  in- 
formation from  NASA,  and  NASA's  responses; 
(2)  NASA  Task  Force  Reports;  (3)  other  corre- 
spondence to  and  from  the  Commission;  (4)  other 
documents  obtained  by  the  Commission;  and  (5) 
reports  and  transcripts  generated  by  the 
Commission. 

The  document  control  system  ensured  that  all 
requests,  documents,  transcript  and  interview 
tapes,  and  other  source  materials  were  properly 
accounted  for,  and  became  part  of  the  Commis- 
sion's permanent  records  and  data  base. 

Documents  Requested  from  NASA 

Most  documents  relevant  to  the  investigation 
came  directly  from  NASA  in  response  to  Com- 
mission requests.  The  Commission  requested 
documents  from  NASA  in  writing  or  verbally  at 
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hearings.  The  Commission  followed  up  verbal  re- 
quests with  written  requests. 

To  handle  the  flow  of  paper,  the  Commission 
assigned  a  staff  member  to  be  document  coor- 
dinator. The  document  coordinator  assigned 
every  written  request  a  unique  control  number. 
The  number  identified  the  date  of  the  request  and 
its  order  of  occurrence  on  that  date. 

NASA  set  up  a  complementary  system.  The 

NASA  coordinator  received  and  logged  Commis- 
sion request  letters,  assigned  unique  NASA  track- 
ing numbers  to  each  item  or  group  of  documents 
requested,  and  followed  up  to  ensure  that  NASA 
staff  responded  promptly  and  fully. 

When  documents  were  received  from  NASA 
corresponding  to  each  numbered  request,  one 
copy  of  each  was  sent  to  the  Support  Center  for 
microfilming,  analysis  (coding),  and  inclusion  in 
the  computer  data  base. 

Correspondence 

Each  individual  piece  of  nonpersonal  mail 
arriving  at  the  Commission  was  assigned  a  cor- 
respondence control  number.  Technical  staff 
evaluated  correspondence  for  investigative  value. 
On  a  microcomputer-based  system,  staff  captured 
critical  information  about  each  correspondence 
item,  including  correspondence  control  number, 
date  of  receipt,  addressee,  author,  type  of  cor- 
respondence, and  response  date  and  type. 

Other  Documents 

The  Commission  also  received  many 
documents  other  than  those  requested  from 
NASA.  These  included  relevant  materials  that 
Commission  members  themselves  had  gathered 
or  generated,  those  from  NASA  and  from  the 
various  NASA  contractors  as  a  result  of  Com- 
mission investigative  activities,  and  incoming  cor- 
respondence that  staff  decided  would  be  of  use 
to  the  investigation.  These  documents  were  also 
entered  into  the  Commission's  data  base,  and 
relevant  correspondence  was  also  entered  into  the 
microcomputer  tracking  system. 

Transcripts  and  Commission-Generated 
Documents 

The  Commission  used  a  court  reporting  firm 
to  transcribe  hearings,  interviews,  and  meetings. 
The  firm  created  magnetic  computer  tapes  with 
the  full  text  of  the  transcripts  and  delivered  the 
tapes  to  be  loaded  into  the  computer  data  base. 

The  firm  also  provided  hard  copies  of  the 
transcripts  to  all  participants  of  the  hearing,  in- 


terview, or  meeting  so  that  they  could  correct  any 
mistakes  made  in  transcription. 

Quick  entry  of  the  transcripts  into  the  data  base 
allowed  timely  search  of  transcript  records  on  a 
word-by-word  basis. 

Processing  of  Documents  and  Tapes  by 
the  Support  Center 

As  described  in  the  previous  section  on  docu- 
ment control,  the  Commission  forwarded  most 
documents  to  the  Support  Center  for  microfilm- 
ing, coding,  inclusion  in  the  computer  data  base, 
and  filing  in  the  library.  These  documents  includ- 
ed NASA  reports  and  documents,  selected  cor- 
respondence, and  other  documents  received  by 
the  Commission. 

Assignment  of  Control  Numbers 

When  the  Support  Center  received  a  docu- 
ment, Center  staff  immediately  applied  a  unique 
preliminary  control  (PC)  number  to  each  page 
of  the  document.  This  number  was  a  sequential 
number  to  indicate  where  the  original  copy  of  the 
document  would  be  located  in  the  library  files. 

Microfilming 

After  control  identifiers  were  assigned,  Center 
staff  microfilmed  the  document  and  placed  the 
original  hard  copy  in  the  library.  The  Center 
made  daily  deliveries  of  completed  microfilm  reels 
to  the  microfilm  processing  facility,  which  pro- 
duced two  copies  of  each  reel. 

The  Support  Center  maintained  one  copy  in 
the  microfilm  library,  and  used  it  to  respond  to 
information  requests  from  Commission  members 
and  staff. 

The  second  copy  was  used  to  produce  hard 
copies  of  the  documents  for  coding  purposes. 


Coding    and    Data    Entry    of    Microfilmed 
Documents 

The  purpose  of  coding  was  to  develop  a  com- 
prehensive computerized  index  of  all  microfilmed 
documents.  Using  hard  copies  produced  from 
microfilm,  each  document  was  reviewed  and 
bibliographic,  control,  and  subject  matter  infor- 
mation was  recorded  on  a  coding  form  designed 
specifically  for  the  Commission  investigation. 

The  bibliographic  information  included  items 
such  as  document  title  and  date,  and  names  and 
organizations  of  people  mentioned  in  the 
documents.  The  control  information  included  the 
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preliminary  control  number,  microfilm  number 
and  other  information  useful  in  identifying  and 
locating  documents. 

To  capture  information  on  subject  matter, 
coders  read  each  document  and  noted  what  sub- 
jects were  mentioned.  The  coders  used  a  list  of 
"subject  terms"  developed  specifically  for  Com- 
mission purposes.  Each  subject  term  had  a  unique 
six-character  identifier.  Every  document  was 
assigned  at  least  one  such  subject  code.  Docu- 
ments that  covered  many  subjects  were  assigned 
multiple  codes. 

Data  entry  operators  keyed  the  index  informa- 
tion from  the  completed  coding  forms  onto 
magnetic  tape  to  be  loaded  into  the  computer  data 
base. 

From  the  date  a  document  was  received,  it  was 
microfilmed,  filed  in  the  hard  copy  and  microfilm 
libraries,  coded,  and  entered  on  the  computer 
data  base  within  one  week.  Throughout  the  proc- 
ess, there  were  numerous  quality  checks  to  en- 
sure the  readability  of  the  microfilm,  the  accuracy 
of  the  document  coding,  and  the  overall  integri- 
ty of  the  data  base. 

Creation  and  Data  Entry  of  Index  Informa- 
tion from  Transcripts  and  Commission 
Generated  Documents 

For  the  Commission  generated  documents  and 
the  transcripts,  index  information  was  captured 
and  entered  into  the  computer.  This  information 
included  date  of  the  hearing  or  report;  names  of 
all  attendees,  Commission  members  or  witnesses; 
and  other  cross-reference  data. 

The  index  information  was  added  to  the  full- 
text  versions  on  the  magnetic  computer  tapes,  and 
loaded  into  the  computer  data  base. 

Creation  of  the  Computer  Data  Base 

Through  the  processes  described  above,  the 
Commission  created  two  computer  data  bases. 
The  first  — called  the  document  data  base,  named 
INQUIRE  — contained  the  index  (bibliographic, 
control,  and  subject  matter  information)  of  all 
microfilmed  documents,  representing  more  than 
100,000  pages. 

The  second  — called  the  full-text  data  base, 
named  JURIS  — contained  the  full  text  of  (1) 
transcripts  of  all  Commission  hearings,  inter- 
views, and  panel  meetings;  and  (2)  Commission 
reports,  hearing  digests,  and  affidavits. 


Libraries 


Documents  and  Microfilm 

As  noted  above,  the  Support  Center  main- 
tained libraries  of  Commission  documents. 

One  contained  the  microfilmed  versions  of  the 
more  than  122,000  pages  of  materials  indexed  on 
the  document  data  base.  The  microfilm  was  filed 
by  reel  number  and  cross-referenced  to  the 
preliminary  control  number  assigned  to  the 
original  hard  copy  of  each  document.  Micro- 
filmed documents  could  be  quickly  located 
through  the  computer  search  capability  and  hard 
copies  printed,  if  desired. 

The  second  library  contained  hard  copies  of 
transcripts  and  other  Commission  generated 
documents  (those  documents  stored  in  the  full- 
text  data  base),  plus  the  originals  of  the  micro- 
filmed documents,  which  could  be  located  by 
using  the  preliminary  control  number. 

Other  Materials 

The  Commission  also  maintained  a  library  of 
video  tapes  of  presentations,  hearings,  photo- 
graphic and  film  records  relating  to  the  accident 
itself,  and  the  salvage  operations.  These  tapes 
were  filed  chronologically  by  date  received  and 
labeled  according  to  subject.  Use  of  these 
materials  was  controlled  through  a  library  check- 
out system. 

Audio  tapes  of  interviews  were  labeled  and 
maintained  at  the  Support  Center.  These  were 
filed  chronologically  by  interview  date  and  con- 
trolled through  a  library  check-out  system. 


Use  of  the  Data  Bases 

The  Support  Center  provided  personnel  to  per- 
form searches  of  both  the  document  data  base 
(INQUIRE)  and  the  full-text  data  base  (JURIS). 
Access  to  INQUIRE  and  JURIS  was  gained 
from  terminals  at  the  Support  Center  and  the 
Commission  offices. 

Detailed  information  on  the  use  of  these 
systems  is  available  in  the  following  OLS 
documentation:  "INQUIRE  Users  Manual," 
"JURIS  Users  Manual,"  and  "Challenger  Data 
Bases  — Sample  Searches  for  JURIS  and 
INQUIRE." 
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The  Document  Data  Base  Accessible 
Through  INQUIRE 

The  INQUIRE  system  allowed  rapid  retrieval 
and  review  of  the  index  information  that  con- 
stituted the  document  data  base. 

Users  who  wanted  to  locate  documents  on  a 
particular  subject  (such  as  O-ring  erosion)  could 
search  the  document  data  base  using  the 
bibliographic  information  or  subject  codes  cap- 
tured for  each  document.  INQUIRE  provided 
a  listing  of  all  documents  matching  the  criteria 
specified  in  the  search.  The  user  could  then  decide 
which  of  the  listed  documents  would  be  useful 
and,  using  the  document  number  provided,  ob- 
tain a  copy  of  the  document  from  the  library. 

The  user  could  ask  INQUIRE  to  list  a  variety 
of  information  on  selected  documents,  including 
the  preliminary  control  number  (used  to  locate 
the  material  in  the  library),  date,  title,  and  docu- 
ment type.  INQUIRE  could  also  print  all  the 
subject  terms  associated  with  each  selected  docu- 
ment (not  just  the  subject  term(s)  that  matched 
the  search  criteria),  and  all  the  names  mentioned 
in  the  text.  Users  could  also  choose  the  order  in 
which  INQUIRE  listed  the  documents  (e.g., 
chronologically  by  document  date,  alphabetical- 
ly by  author  name,  or  numerically  by  document 
number). 

The  Full-Text  Data  Base  Accessible 
Through  JURIS 

The  Department  of  Justice  developed  JURIS 
specifically  for  retrieval  of  full-text  information, 
and  designed  it  for  easy  use  by  nontechnical  per- 
sonnel. Users  could  ask  JURIS  to  locate  all 
documents  containing  specific  words  or  phrases. 
Users  could  specify  multiple  words  or  phrases, 
and  could  include  index  information  as  one  of  the 
search  criteria.  Users  could  request  that  JURIS 
print  a  list  of  documents  that  were  selected,  or 
print  the  full  text  of  the  documents. 

Final  Disposition  of  Commission 
Report  and  Investigation-Related 
Materials 

The  entire  collection  of  documents  and 
microfilm  is  permanently  housed  in  the  National 
Archives.  In  addition,  several  different  indices 
and  other  supporting  documentation  were  com- 


piled to  assist  historians  and  others  in  using  and 
gaining  access  to  this  large  and  very  important 
collection. 

These  materials  were  provided  to  the  National 
Archives  in  accordance  with  the  procedures 
described  in  FPMR  101-11.4,  "General  Records 
Schedules,"  published  by  the  National  Archives 
and  Records  Administration,  and  specifically 
Schedule  24  which  focuses  on  "Temporary  Com- 
missions, Committees,  and  Boards  Records." 

Materials  Provided 

The  following  materials  were  turned  over  to 
the  Archives  at  the  conclusion  of  the  investigation: 

■  The  Commission's  Report,  including  all 
appendices; 

■  All  materials  requested  and  received  by 
the  Commission  from  NASA  and  its  con- 
tractors, including  the  NASA  Task  Force 
reports; 

■  All  documents  provided  to  the  Commis- 
sion and  its  staff  at  hearings,  meetings, 
presentations,  and  interviews; 

■  The  entire  microfilm  collection  contain- 
ing those  materials  (both  in  open-reel  and 
cartridge  format),  as  well  as  a  file-level 
index  to  each  reel; 

■  All  transcripts  of  hearings,  panel  meetings 
and  interviews; 

■  Summaries  of  all  hearing  transcripts  and 
significant  interview  transcripts; 

■  Indices  to  the  INQUIRE  (document) 
data  base,  listing  all  of  the  documents  by 
document  number,  date,  and  subject 
term; 

■  All  correspondence  and  respective 
responses,  as  well  as  indices  to  the  entire 
correspondence  collection  sorted  by 
author,  correspondence  type,  and  date  of 
receipt; 

■  Computer  tapes  containing  the  entire  IN- 
QUIRE data  base  prepared  for  and  used 
by  the  Commission  in  the  course  of  its 
investigation; 

■  Complete  set  of  the  request  letters  sent  by 
the  Commission  to  NASA,  the  resulting 
Action  Item  forms,  and  the  responsive 
memoranda  that  closed  out  each  of  those 
Action  Items; 

■  All  press  releases  produced  by  the 
Commission; 
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All  video  and  audio  tapes  received  by  the  Public  Access 

Commission,  including  indices  to  those  To  gain  access  to  the  Commission's 

two  collections;  and  documents,  requests  can  be  made  to: 

All  planning  and  instructional  materials  Office  of  the  National  Archives 

related  to  the  creation  and  use  of  the  IN-  National  Archives  and  Records 

QUIRE  and  JURIS  data  bases.  Administration 

Washington,  DC  20408 
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Appendix  C 


Observations  Concerning  the 
Processing  and  Assembly  of 
Flight  51-L 


The  following  examples  of  Operational 
Maintenance  Requirements  and  Specifications 
Document  violations  were  noted  during  the  Com- 
mission's inquiry: 1 

1.  The  Operational  Maintenance  Re- 
quirements and  Specifications  Document 
indicated  that  the  External  Tank  liquid 
hydrogen  and  liquid  oxygen  ullage 
pressure  control  and  redundancy  verifica- 
tion using  simulated  transducers  was  a  re- 
quirement for  this  processing.  However, 
the  entire  sequence  was  marked  "not  per- 
formed" in  the  documentation,  indicating 
that  it  had  not  been  completed.  Missing 
any  of  these  steps  has  implications  for  safe- 
ty of  flight. 

2.  The  three  requirements  that  verify  the 
main  engine  pneumatic  isolation  valve  ac- 
tuation were  not  met  as  specifically  called 
for  in  the  Operational  Maintenance  Re- 
quirements and  Specifications  Document. 
The  intent  of  the  requirement  was  met. 

3.  One  requirement  (main  engine  pneumatic 
isolation  check  valve  individual  flow- 
through  test)  was  not  met  in  the  Opera- 
tions &  Maintenance  Instructions.  The 
main  engine  flight  readiness  tests  gave 
assurance  that  at  least  one  of  two  check 
valves  per  system  was  working. 

4.  A  main  engine  pneumatic  regulator  func- 
tional test,  which  checks  the  redundancy 
of  individual  regulators,  was  not  verified 
under  flow  conditions. 

5.  The  results  of  helium  pneumatic  low 
pressure  system  decay  check  (with  closing 
solenoids    energized)    exceeded    the 


allowable  limit.  The  decay  rate  was 
recorded  as  0.98  pounds  per  square  inch 
per  minute;  however,  a  recalculation  of  the 
data  revealed  that  the  decay  rate  was  ac- 
tually 1.4  pounds  per  square  inch  per 
minute.  The  calculated  allowable  decay 
rate  was  1.35  pounds  per  square  inch  per 
minute  maximum. 

6.  The  leak  check  steps  for  test  port  Number 
4,  after  installation  of  the  plug,  were  in- 
advertently omitted  from  the  Operations 
&  Maintenance  Instructions. 

7.  Main  engine  protective  covers  were  not 
installed  at  times  required.  A  revision  to 
the  requirement  is  needed. 

8.  Several  requirements  cannot  be  satisfied 
during  a  24-hour  launch  scrub  turnaround 
due  to  lack  of  access.  A  revision  to  the  re- 
quirement is  needed. 

9.  The  humidity  indicator  inspection  require- 
ment was  not  met  because  the  engines 
were  not  in  the  controlled  environment 
with  a  trickle  purge  on.  The  requirement 
needs  to  be  updated. 

Representative  samples  were  taken  from  the 
Orbiter  processing  paper.  Of  121  Operations  & 
Maintenance  Instructions  reviewed,  47  percent 
had  paper  errors.  Incomplete,  incorrect  or  miss- 
ing data  recording  points  were  found  in  about  13 
percent  of  the  cases  and  32  percent  had  Quality 
Control  buy-off  stamps  missing. 

Also  reviewed  were  479  Work  Authorization 
Documents  in  the  Interim  Problem  Report,  Prob- 
lem Report  and  Test  Preparation  Sheet 
categories.  Of  those  documents,  70  percent  had 
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anomalies,  including  inaccurate/inadequate  level 
of  detail  (36  percent),  missing  stamps  (24  per- 
cent), correct  signatures  not  obtained  (29  per- 
cent), and  inaccurately  detailed  summary  for 
closure  or  deferral  (20  percent). 

In  addition  to  normal  processing,  there  were 
22  Modification  Change  Requests  applicable  to 
flight  51-L.  Those  requests  generated  51  Work 
Authorization  Documents,  all  of  which  were 
reviewed  as  part  of  the  post-accident  study  of 
flight  51-L  processing.  Although  not  accident- 
related,  96  percent  of  the  Work  Authorization 
Documents  were  found  to  have  errors  of  an  ad- 
ministrative or  format  nature.  Those  examples 
led  to  the  conclusion  that  there  was  a  pervasive 
lack  of  discipline  and  lack  of  proper  training  with 
respect  to  how  Work  Authorization  Documents 
are  written  and  implemented.2 

The  same  lack  of  completeness  and  accuracy 
was  discovered  in  review  of  nearly  all  types  of 
paperwork  in  the  processing  system.  The  amount 
of  flawed  paper  work  — approximately  50 
percent  — is  unacceptable.  There  are  several  con- 
tributing factors,  among  them  signature  re- 
quirements that  are  lengthy  and  require  people 
to  travel  long  distances  to  accomplish,  excessively 
long  times  required  to  close  out  paper,  as  com- 
pared with  doing  the  actual  work;  lack  of 
understanding  of  the  paper  system;  a  complicated 
tiered  control  and  status  trail  for  Quality 
Assurance  personnel;  and  the  fact  that  no  single 
organization  has  the  responsibility  for  final  review 
for  closure.  Basically,  the  system  is  not  simplified 
for  the  originator,  performer,  or  verifier. 
Therefore,  it  is  not  a  useful  tool,  which  would  be 
the  only  reason  for  its  existence.  Rather,  it  is  an 
impediment  to  good  work  and  good  records.3 

The  work  control  documentation  system  is 
cumbersome  and  difficult  to  use.  Consequently, 
the  work  force  does  not  try  very  hard  to  use  it. 
The  result  is  that  the  real-time  execution  of  tasks 
and  their  subsequent  traceability  suffer.  The 
system  needs  to  be  simplified  so  that  it  becomes 
"user  friendly."  Once  it  is,  the  work  force  should 
be  trained  to  use  it  and  management  should  place 
proper  emphasis  on  rigorous  observance  of  the 
documentation  requirements. 


Flight  51-L  Booster  Processing 

With  Shuttle  mission  STS-6  in  April  1983, 
NASA  introduced  the  "lightweight"  version  of  the 
Solid  Rocket  Booster,  about  4,000  pounds  lighter 


than  its  185,000-pound  (empty  weight)  prede- 
cessors. The  weight  reduction  was  achieved  by 
shaving  the  thickness  of  each  steel  casing  by  two 
to  four  hundredths  of  an  inch.  On  flight  51-L. 
all  but  the  forward  segments  of  the  two  boosters 
had  lightweight  casings. 

There  are  1 1  separate  case  components  in  each 
Solid  Rocket  Booster.  Only  two  of  the  22  com- 
ponents in  the  51-L  stack  were  new.  The  remain- 
ing 20  components  had  been  used  a  combined 
total  of  29  times  previously,  in  ground  tests  and 
in  flight. 

The  new  components  were  the  right  forward 
center  tang  and  the  left  forward  dome.  The  right 
forward  segment  (Number  085)  had  been  part  of 
the  flight  51-C  (January  24-27,  1985)  left  forward 
field  joint  that  had  experienced  O-ring  erosion 
and  deposited  soot  behind  the  primary  O-ring. 
None  of  the  other  51-L  case  segments  had  ex- 
perienced O-ring  problems  on  previous  use. 

Segment  L-60,  the  right  aft  center  tang  com- 
ponent, had  been  flown  on  41-D  (August 
30  — September  5,  1984)  as  the  left  forward  center 
tang  component.  Segment  L-06,  the  right  aft 
clevis  component,  had  been  flown  on  51-C  as  the 
left  aft  clevis  member.  Segment  L-06  had 
undergone  another  burn  in  addition  to  51-C;  it 
had  been  used  as  part  of  the  left  aft  segment  in 
a  static  test  firing.4 

The  first  of  the  eight  motor  segments  for  flight 
51-L  arrived  by  rail  at  Kennedy  Space  Center 
on  October  1 1 ,  1985.  The  last  reached  Kennedy 
on  November  4.  The  segments  for  51-L  were 
designated  booster  integration  set  BI026. 

Grain  inspection  and  offloading  began  on  Oc- 
tober 24.  Stacking  preliminaries  for  the  left 
booster  got  under  way  on  October  28  with  the 
mating  of  the  aft  segment  to  the  skirt  that  sur- 
rounds the  nozzle.  The  stacking  of  the  right 
booster  began  on  December  4.  During  the  stack- 
ing operation,  which  involves  assembling  the 
components  of  the  Solid  Rocket  Booster  one  atop 
the  other  on  the  Mobile  Launch  Platform  (MLP), 
a  number  of  minor  deviations  and  a  few  unusual 
situations  were  experienced.  They  were  careful- 
ly reviewed  by  the  NASA  report  team  and  by  the 
Commission.  Wfith  one  possible  exception,  ex- 
plained below,  these  incidents  did  not  have 
significant  impact  on  the  performance  of  the  Solid 
Rocket  Boosters. 

Before  stacking  of  the  right  hand  booster, 
measurements  of  the  right  aft  center  tang  and  the 
right  aft  clevis  diameters  indicated  a  potential  for 
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Drawing  depicts  steps  in  the  stacking  of  the  aft  and  aft  center 
segments  of  the  Solid  Rocket  Booster  in  the  Vehicle  Assem- 
bly Building  (VAB). 
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stacking  interference.  Taken  across  the  0-180 
degree  axis,  the  tang  diameter  measurement  ex- 
ceeded the  corresponding  clevis  dimension  by 
+  .512  inch.  The  maximum  allowable  tang  to 
clevis  difference  is   +  .250  inch. 

Normal  Operations  and  Maintenance  Instruc- 
tions procedures  were  followed  for  bringing  the 
out-of-round  segment  into  allowable  tolerances. 
While  the  right  aft  center  segment  was  hanging 
from  four  points  on  a  lifting  beam,  the  first  step 
was  to  adjust  the  lifting  beam  to  create  a  two- 
point  lift  across  the  90-270  degree  axis.  The 
weight  of  the  segment  itself  would  decrease  the 
tang  diameter  across  the  0-180  degree  axis.  This 
process    reduced    the    excess    measurement    to 


+  .334  inch,  but  it  was  still  outside  the  allowable 
tolerance. 

The  next  step  in  the  procedure  was  to  install 
the  circumferential  alignment  tool.  It  was  in- 
stalled across  the  16-196  degree  axis  and  max- 
imum allowable  pressure  of  1,200  pounds  per 
square  inch  gauge  was  applied  to  the  tool.  This 
produced  a  further  improvement,  but  again  fell 
short  of  the  measurement  requirements.  Addi- 
tional deflection  was  obtained  by  turning  the  hex 
nut  on  the  alignment  tool.  This  caused  the 
hydraulic  pressure  on  the  tool  to  increase  to 
1 ,300-1 ,500  pounds  per  square  inch  gauge,  which 
exceeded  the  limit  on  the  tool.  The  procedure  pro- 
duced a  force  of  3,254-3,766  pounds  on  the  seg- 
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Table  1 

Right  Aft  Center  Segment  Tang 

to  Aft  Segment  Clevis  Diameter 

Measurement  Differentials  Taken  on  December  7,  1985 

(Positive  is  Tang  Larger) 


Inter- 

Alignment 

Initial 

mediate 

Final 

Tool 

Alignment 

4-Point 

2-Point 

2-Point 

2-Point 

Installed 

Tool 

Circumferential 

Lift 

Lift 

Lift 

Lift 

16°/196° 

Removed 

Location 

0145  hrs 

0305  hrs 

0354  hrs 

0415  hrs 

0925  hrs 

0945  hrs 

0° 

+  .512 

+  .393 

+  .334 

+  .334 

+  .138 

+  .216 

30° 

+  .158 

+  .295 

+  .315 

+  .315 

N/A 

+  .158 

60° 

-  .334 

-.236 

-.157 

-.157 

-.079 

-.118 

90° 

-  .728 

-.571 

-.531 

-  .531 

-  .295 

-  .334 

120° 

-.669 

-  .571 

-.531 

-  .531 

-.374 

-.393 

150° 

+  .059 

0 

+  .020 

+  .020 

-  .39 

-  .059 

NOTE:  Measurements  to  nearest  .001  inch  are  approximate 


merit  case,  which  was  within  manufacturer 
specifications.  Although  this  procedure  was  at 
that  time  authorized  by  the  Operations  and 
Maintenance  Instruction,  it  has  since  been 
deleted  because  the  application  of  increased 
pressure  on  the  alignment  tool  risks  damage  to 
the  tool. 

Following  all  of  these  procedures,  measurement 
of  the  tang  showed  the  differential  between  the 
tang  and  clevis  along  the  0-180  degree  axis  to  be 
+  .138  inch,  which  was  considered  suitable  for 
mate.  The  right  aft  center  segment  was  hoisted 
from  the  transfer  aisle  and  lowered  into  position 
above  the  aft  segment  in  the  Vehicle  Assembly 
Building  high  bay.  The  alignment  tool  was 
removed  and  final  tang  measurements  showed  a 
differential  of  +  .216  inch,  indicating  mating  was 
possible.  Installation  of  both  O-rings  and  suc- 
cessful stacking  of  the  segments  then  took  place 
without  incident.  No  further  problems  were  iden- 
tified during  engagement  of  the  two  segments. 
Table  1  shows  the  measurements  taken  at  various 
stages  of  the  entire  procedure.5 

The  several  sets  of  tang/clevis  diametric 
measurements  referred  to  in  the  foregoing  discus- 
sion, and  presented  in  Table  1,  were  reported  by 
the  stacking  crews  at  Kennedy. 

Two  conspicuous  aspects  of  the  51-L  right  aft 
field  joint  warrant  comparison  with  joint  history 
of  earlier  flights.  Those  aspects  are  the  use  of  the 


circumferential  alignment  tool  and  the  large  tang- 
to-clevis  negative  diameter  difference  of  -  .393 
inch  along  the  120-300-degree  axis.  However,  the 
NASA  Operations  and  Maintenance  Instructions 
do  not  specify  a  limit  to  negative  differences  be- 
tween tang  and  clevis. 

The  alignment  tool  had  been  used  five  times 
previously;  its  usage  is  shown  in  Table  2.6 

Table  2 

Alignment  Tool  Use  History 


Mission 

Field  Joint 

O-Ring  Damage 

51-B 

Left  Aft 

None 

51-F 

Left  Fwd 

None 

61-B 

Left  Aft 

None 

61-C  (2  joints) 

(Left  Aft 
(Right  Aft 

Erosion 

None 

Of  the  five  field  joints  on  which  the  alignment 
tool  was  used,  one  experienced  erosion. 

There  were  13  Solid  Rocket  Booster  joints  on 
missions  51-C  (January  1985)  through  61-C 
(January  1986)  that  had  negative  differences 
greater  than  -.320  inch.  Three  of  those  joints  had 
negative  differences  greater  than  the  51-L  right 
aft  field  joint.  None  of  those  13  earlier  joints  ex- 
perienced O-ring  damage.  Table  3  indicates  the 
joints  and  missions  with  negative  differences 
greater  than  -.320  inch.7 
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Table  3 

Negative  Diameter  Differences  Greater  Than  .320 

Inches  for  Field  Joints:  STS  51-C  Through  61-C 


Mission 

Difference 

Location 

(Inches) 

(Degrees) 

51  -C 

Right  Fwd 

-  .360 

120 

51  -  B 

Right  Aft 

-.360 
-.372 

90 
120 

Right  Fwd 

-.336 

0 

51  -D 

Left  Aft 

-.324 

120 

Left  Fwd 

-.372 

120 

51  -G 

Right  Aft 

-  .354 

120 

51  -F 

Right  Center 

-  .385 

-  .433* 

0 
150 

51  -I 

Left  Center 

-  .335 

0 

Right  Aft 

-.327 

30 

61  -B 

Left  Center 

-.334 

150 

Right  Center 

-  .473* 

120 

61  -C 

Left  Center 

-  .355 

-  .354 

150 
0 

Right  Center 

-  .394* 

120 

*Xegai 

ive  diameter  differences  greater  th 

an  51-L. 

It  was  found  that  the  negative  dimension  dif- 
ferences on  51-L  were  not  the  most  troublesome 
ever  experienced  and  that  a  significant  number 
of  joints  on  other  flights  had  initial  negative  dif- 
ferences in  excess  of  the  worst-case  design 
clearance  between  the  tang  and  the  clevis.  One 
significant  uncertainty  is  the  degree  to  which 
segments  may  tend  to  circularity  after  being 
mated. 

The  procedures  used  in  mating  the  right  side 
aft  and  aft  center  segments  were  carefully  exam- 
ined and  appear  normal,  properly  followed  and 
executed  by  well-experienced  personnel  according 
to  specifications. 

The  51-L  joint  negative  diameter  difference  has 
been  examined  for  the  light  it  may  shed  on 
whether  this  discrepancy  may  have  contributed 
to  the  fatal  booster  joint  failure. 

The  large  negative  diameter  difference  in- 
dicates a  potential  for  an  interference  between  the 
tang  and  inner  clevis  leg  that  can  lead  to  a  flat 
on  flat  condition  when  the  tang  section  is  lowered 
into  the  clevis  section  on  assembly. 

Subscale  test  on  sections  of  the  full  scale  joint 
cross  section  were  performed  which  purposely 
produced  a  flat  on  flat  condition  as  these  sector 
sections  were  forced  together.  Test  results  showed 
that  metal  slivers  were  sheared  from  the  flats,  and 


that  these  slivers  could  be  pulled  into  the  O-ring 
region  during  assembly. 

However,  a  flat  on  flat  condition  probably  did 
not  exist  on  the  STS  51-L  lower  joint.  Past 
assembly  practice  has  shown  that  if  the  difference 
of  all  diametrical  readings  of  the  mating  hakes  is 
less  than  +  .250  inches  a  flat  on  flat  condition  will 
not  occur.  Furthermore  during  the  mating  proc- 
ess the  halves  are  brought  slowly  together  with 
stacking  personnel  positioned  around  the  joint. 
A  potential  for  flat  on  flat  is  looked  for  during 
this  critical  period.  It  has  been  shown  through 
experience  that  a  flat  on  flat  condition  is  readily 
apparent  when  viewing  the  mating  section  while 
the  upper  tang  section  is  suspended  just  above 
the  inner  leg  of  the  clevis.  Thus  both  the  physical 
measurements  and  assembly  procedures  make  a 
flat  on  flat  condition  unlikely  during  assembly. 

While  the  tang  of  the  51-L  right  aft  center  seg- 
ment was  burned  through  near  the  300  degree 
arc  point  where  the  largest  negative  dimension 
occurred,  this  dimension  was  an  assembly  con- 
dition only  and  it  is  not  certain  that  it  persisted 
until  launch.  Examination  of  the  STS  61 -E 
destacked  segments  subsequent  to  the  51-L  acci- 
dent indicated  that  their  ovality  had  changed  after 
assembly  while  awaiting  launch. 

If  the  very  tight  tang-to-clevis  assembly  gap  did 
persist  to  time  of  launch,  it  could  have  resulted 
in  near  maximum  compression  of  the  O-rings. 
Such  compression,  in  conjunction  with  cold 
temperatures,  joint  dynamics,  and  the  variable 
performance  of  the  insulating  putty  has  been 
shown  to  have  detrimental  influences  on  the 
joint's  ability  to  seal.  Several  joints  on  STS  51-L, 
however,  may  have  had  areas  where  the  O-ring 
was  at  near  maximum  compression. 
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Center 
Comptroller 

stratjve 

Operations 
Office 
D  Bean 

Equal 

Oooor'unit, 

Office 
C  Fosie' 


NASA  Inspector 
General 


Regional  Office 
J  Nugent 


Space  Telescope 
Protect 
Office 
J  B  Odom 


Spacelab 

Program 

Office 

John  w  Thomas 


SpaceiaB 
3a,  Dad 
Project 
Office 

J    Do .-. "  e .    II 


Space 
Station 
Protects 
Office 
L  Powell 


Director  of 
Science  and 
Engineering 


Director  of 
Institutional  and 
Program  Support 
J  N  Foster 


Science  and  Engineering  Directorate 

Incumbents  as  of  January  28.  1986 


Director 

James  E   - 

George  Hardy  (Depu' 


Associate  Director  for 

Management 

J   G   Sturdivant 


Reliability  and 

■  surance 
Offce 

Bunn 


Information  & 
Electronic 
Systems 
Laboratory 
W  C   Bradford 

Materials  and 

Processes 

Laboratory 

R  J  Schwinghamer 

Systems 
Analysis  and 
Integration 
Laboratory 
G  D  Hooson 


Associate  Director  for 

Engineering 

J  Wayne  Littles 


Research  and 
Technology 

Offce 


Space 
Science 
Laboratory 
A  J  Oessier 


Structures  and 
Propulsion 
Laboratory 
A  A  McCooi 


Systems 

Dynamics 

Laboratory 

G  F  McDonough 


Test 

Laboratory 

H  R  Coldwater 
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Shuttle  Projects  Office 

Incumbents  as  of  January  28.  1986 


KSC  Resident 
Offce 


"Staffed  by  Science  and  Engineering  Personnel 


Program  Plans 
and  Management 
Systems  Office 
J  Boze 


Resources 

Management 
Office 


_     Management 
Systems  Office 


Program 
Planning  Office 


Manage! 

S  R  Reman* 

J   Lovingood  (Deputy) 


Systems 

Management 

Office 


•Chief 
Engineer 


Vehicle  Systems 
Office 


Integration 
Office 


Ground  Operations 

and 

Logistics  Office 


External  Tank 

P   Bridwell 


•Chief 
Engineer 


:  n  and 
Protect  Engineering 
Offce 


Protect  : 

Offce 


Mchoud  Assembly 


Booster 
Protect 


Integration 
Offce 


Motor  Offce 


Engineer 
J  Smith 


Booster  Assemb  . 

Office 


KSC-SRB 
Resident  Office 


Bngham  City 
Resident  Offce 


Right  Engine 
Project 


Protect 
Offce 


Project 
Control 
Office 


Chief 
Engineer 


Production  and 
Logistics  Office 


Canoga  Park 

Resident  Office 


NSTL  Resident 
Office 


Engine 
Project 


'Chief 
Engineer 


Project 

Engineering 

Office 


Control 
Offce 


ntegrat  on  and 
Test 
Offce 


Key  Marshall  Personnel  Related 
to  the  Solid  Rocket  Booster 


Shuttle  Projects  Office 
Reinaru  9  85-4/86 
Undstrom4.74-6  85 


Science  and  Engineering 
Directorate 
Director:  Kingsbury 
Deputy  Hardy  4  84-presen; 


SRB  Protect 

82  present 


SRM 
lOSZp'esenr 


Associate  Director 
J  Wayne 


^  ^ 


SRM  Chief  Engineer 


SRB  Chiel  ■ 


Leon  Ray 


SRM  Project  Eng 
Keith  Coates 
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Morton  Thiokol,  Inc. 

Incumbents  as  of  January  28.  1986 


Chairman  of  the  Board 

and 

Chief  Executive  Officer 

Charles  S  Locke 


Vice  President 
Finance 
John  R   Bowen 


President  and 

Chief  Operating  Officer 

Robert  C    Hyndman 


Vice  President 
for  Legal  Affairs 
and  General  Counsel 
Robert  B  Geme 


President 
Aerospace  Group 

U   Edwin  Garrison 


Vice  President 
Management  Information 
and  Services 
Perry  R  Grace 


Vice  President 
Human  Resources 
Hugh  C   Marx 


Vice  President 
Corporate  Development 
and  Strategic  Planning 
Thomas  S    - 


Group  Vice  President 

Salt 

William  E   Johnston.  Jr 


Group  Vice  President 

Chemicals 

S  Jay  Stewart 


Senior  Vice  President 
Wasatch  Operations 
Jera'd  E  Mason 
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Morton  Thiokol  27  Jan  1986 
Meeting  Participants 


Sr.  Vice  President 
Wasatch  Operations 
J  E  Mason 


Vice  President  and 
General  Manager 
Space  Division 
C  G  Wiggins 


Vice  President 
Space  Booster 
Programs 
J  C  Kilmmster 


Vice  President 
Space  Services 
Carver  G   Kennedy 
(at  KSC) 


Vice  President 
Engineering 
R  K  Lund 


Manager 
KSC  Office 

.    3.:'=/  a " 


Director 
Solid  Rocket 
Motor 


Manager 
Space  Shuttle 
Proiect  Engineering 
B  C   E- 


Manager 
SRM  Igniter  and 
Final  Assembly 
R  B  Ebeiing 


Director 

Engineering  Design 
L  H  Sayer 


Manager 
Case  Protects 
A  W  Macbeth 


Manager 

Applied  Mechanics 

J  R  Kapp 


Program  Manager 
B  G  Russell 


Manager 

Motor  Performance 


Staff  Engineer 
R   M   Boisioly 


Supervisor 

A    R   Thompson 


Supervisor 
Gas  Dynamics 
0  M  Ketner 


Supervisor 
Heat  Transfer 


Supervisor 
Ballistics 


Engineer 
K  J  Speas 
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Temperature  Definitions 

as  applicable  to  this  report 


Parameter 


Definition 


Field  Joint  (O-ring)  Temperature 


A  calculated  temperature  for  the  surface  of  the  Solid  Rocket  Booster 
in  the  vicinity  of  the  tang/clevis  joint.  The  O-ring  temperature  is 
assumed  to  be  the  same.  Calculations  are  based  on  a  thermal  model 
which  includes  ambient  temperature  among  the  variables.  (See 
references  1  and  2.) 


Ambient  Temperature  (at  launch) 


Measured  atmospheric  temperature  at:  (See  reference  3) 

■  Camera  Site  3,  approximately  1,000  feet,  bearing  150  degrees  from 
Launch  Pad  39B  (36  degrees  Fahrenheit  at  launch). 

■  At  a  weather  observation  site  approximately  3,000  feet  east  of  the 
Kennedy  Shuttle  Landing  Facility;  (reported  minimum  of  24 
degrees  Fahrenheit  and  maximum  of  43  degrees  Fahrenheit  for 
January  28,  1986). 


References 


1.  Report,  "Accident  Analysis  Team  Report,  Solid  Rocket 
Motor  Working  Group,  NASA,  April  1986".  pages  B-105  through 
B-114. 

2.  Commission  Panel  Work  Session  (Solid  Rocket  Booster  mat- 
ters) Design  and  Production  Panel;  Brigham  City,  Utah,  March 
18.  1986,  pages  392  through  403. 

3.  Report,  "Accident  Analysis  Team  Report,  Space  Shuttle 
Systems  Working  Group.  NASA,  April  1986",  pages  18  through 
23.  Tables  B.l  and  B.2. 

Note:  A  comparison  of  atmospheric  environmental  data  (wind, 
temperature,  precipitation)  for  Flights  STS-1  through  STS 
61 -C  is  included  in  Tables  B.5  and  B.6  of  reference  3. 
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Early  Marshall  documents  and  memoranda  raising  design  objections 


IMCAMilAHCM 

EP25 

MARSHALL  SPACE  FLIGHT  CENTER 

MAMIi 

LEON  RAY 

SRM  ILLVlb  JU1NI  LLHNHUt  OIUUI 

Mill 

OCTOBER  21 ,  1977 

OPTIONS 

DESIGN  OPTIONS 

REMARKS 

1.  KG  CHANGE 

o  UNACCEPTABLE  -TANG  CAN  MOVE  OUTBOARD  AND  CAUSE  EXCESSIVE  JOINT 
CLEARANCE  RESULTING  IN  SEAL  LEAKAGE. 

0  ECCENTRIC  TANG/CLEVIS  INTERFACE  CAN  CAUSE  0-RING  EXTRUSION  WHEN 
CASE  IS  PRESSURIZED. 

2.  SHIMS  BETWEEN  TANG  AND 
CLEVIS  (OUTSIDE) 

0  ACCEPTABLE  SHORT-TERM  FIX  IF  PROPFR  SHIM  SIZE  IS  USED. 

0  PROBABILITY  OF  ERROR  IN  CALCULATING  PROPER  SHIM  SIZE. 

0  REOUIRES  INCREASED  ASSEMBLY  TIME  FOR  SHIM  INSTALLATION  AND  JOINT 
CENTERING. 

3.  OVERSIZED  0- RINGS 

0  UNACCEPTABLE  SOLUTION  -  HIGH  PROBABILITY  OF  O-RING  DAMAGE 
OR  CLEVIS  DISTORTION  DURING  ASSEMBLY. 

o  DEPARTS  FROM  RECOMMENDED  DESIGN  PRACTICES. 

4.  REDESIGN  TANG  AND  REDUCE 
TOLERANCE  ON  CLEVIS 

0  BEST  OPTION  FOR  LONG-TERM  FIX  -  ELIMINATES  USE  OF  SHIMS  WHEN 
ALL  REDESIGNED  HARDWARE  IS  USED. 

0  PREVENTS  THE  TYPE  OF  ERROR  WHICH  COULD  RESULT  IN  CALCULATING 
JOINT  CLEARANCE  FOR  SHIM  INSTALLATION. 

5.  COMBINATION  OF  REDESIGN 
(AS  IN  0PT1CK  4)  AND 

USE  OF  SHINS 

0  ACCEPTABLE  APPROACH.   SHIMS  WILL  BE  REQUIRED  IN  SOME  CASES 
WHEN  REDESIGNED  HARDWARE  AND  PRESENT  HARDWARE  IS  JOINTED. 

0  SHIMS  WILL  BE  DISCONTINUED  WHEN  PRESENT  HARDWARE  IS  PHASED  OUT. 

This  briefing  chart  is  the  earliest  known  indication  that  the  joint 
design  was  unacceptable.  Leon  Ray,  in  a  1977  briefing  on  a 
planned  Structural  Test  Article  test  indicates  that  not  changing 
the  design  is  unacceptable  since  the  tang  can  move  outboard 
and  cause  excessive  joint  clearance  resulting  in  seal  leakage. 


233 


G-X*g«  C  Mindl  Spac*  FMgN  Cwl« 
3581? 


EP25  (7S-1) 


NASA 


Jjnuiry    9,    1978 


EE51/Mr.   Eudy 
EP25/Hr.  Miller 


Restatement  of  Position  on  SRfT  Clevis  Joint  0-Rlng 
Acceptance  Criteria  and  Clevis  Joint  Shim  Requi remen ts 


In  view  of  recent  events  relating  to  proposals  suggesting  the  relaxation 
of  standards  for  clevis  Joint  0-r1ng  acceptance  and  the  use  of  a  standard 
shim  thickness   for  clevis  Joints  which  allows  0-ring  compression  to  fall 
belov«  minimum  Industry  accepted  values,   this  office  feels  obligated  to 
restate  its  opposition  to  both  proposals.     The  following  paragraphs 
address  each  of  the  related  subjects   in  terms  of  events   leading  to  such 
recommendations,   risks   involved  by  lowering  standards,  and  1 1 1  ip— i iiiJmL Iuiii 
to  resolve  risks. 

a.     Relaxation  of  O-Rinq  Acceptance  Standards  -  During  the  latter  part 
of  November  1977,   this  office  was   requested  by  memorandum  EE51   (77-291) 
to  review  Thiokol   documents  STW7-2875,  Standard  Acceptance  Criteria  for 
Preformed  Packing   (O-Rtnas)   and  171-136,  Standard  Repair  Instructions   for 
0-P.lngs   (see  enclosure  1}.     Our  response,  whlcir  was  documented  in  memorandum 
EP25   (77-108)  dated  November  30,   1977  (see  enclosure  2),   recommended 
rejection  of  both  documents  because  of  excessive  deviations   fro™  MIL-STD-413 
requirements,   "visual   Inspection   for  rubber  0-r1ngs",  and  for  lack  of 
clarification  on  several   subjects.     Our  memorandum  also  outlined  recommended 
allowable  flaw  sizes  per  MIL-STO-413  and  allowables  for  other  types  of 
defects  which  were  not  contained  In  MIL-STD-413.     On  December  22,  1977.  we 
were  provided  with  and  asked  to  comment  on  a  draft  copy  of  memorandum  EE51 
(77-321*   to  program  management   (see  enclosure  3)  *hich  contained  EE51 
comrent;  and  recommendations   to  Thiokol   doe^ents  STW7-23*5  srd  171-135 
.fhlcl  were  not  in  agreement  with  our  previous  assessment.     Eecause  of  ties* 
differences  and  to  further  amplify  our  position  concerning  0-r1ng  defecc 
allowables,   the  following  recommendations  and  Justifications  are  restated: 

(1)      Inclusions  -  Remove  all   visible  Inclusions   regardless  of 
size  or  type  of  Included  material.     The  Included  naterlal   can  be  detached 
fj'1-ig  O-'li'g   Installation   i'"J  use,  creating  djbrls  and  prcbable  leakage. 
S.-.:a1r  'i  required  if   '.re   /--suiting  void  exceei;  0.02S   irch  Ji;rec»r  by 
0.005  inch  deep.     Oeeper  voids  create  a  greater  risk  for  1-ai^ve  w1tn   low 
compression   (example:     a  void   .015   Inch  deep  reduces  compression  effect 
by  5.5  percent). 


(2)  nold  Deposit  Effects,  Pits,  and  Voids   -  Each  defect  must  be 
treated  according  to  defect  shape.     Oefects  having  sharp  edges  should  be 
treated  as  a  notch  sensitive  cut  and  repaired  if  the  de'ect  exceeds  0.D2S 
Inch  diameter  by  0.002  inch  deep.     Defects  having  smuth  shapes  should  be 
repaired   If  either  the  diameter  or  depth  exceeds  0.02S   Inch  and  0.005   Inch, 
respectively. 

(3)  Cuts  -  Radial   cuts  other  than  superficial   cuts   (cuts  which 
cannot  be   felt  with   the   thumbnail)  are  not  allowed  and  must  be  repaired 

or  dtsposltloned  by  splicing  or  rejectloo.     The  orientation  of  radial   cuts   Is 
Such  that  stretching  of  the  0-rlng  can  cause  further-tearing.     Cuts  parallel- 
to  the  0-rlng  longitudinal   ails  must  not  exceed  0.002.  Inch  deep  by  0.060 
Inch  long. 

(4)  Repair  Limitations  -  The  limitations  on  maximum  defect  size 
acceptable  for  repair  should  be  based  on  results  of  Thiokol 's  test  program 
per  TwH-11507.     Deviations  should  be  approved  by  EH01 . 

b.     Below  Minimum  0-Rlnq  Compression  -  Prior  to  the  static  firing  of  Cm-1 
1n  June  1977.  snlms  were  Installed  in  the  clevis  Joints  to  stop  seal   leakage 
caused  by  tang  distortion.     Shims  of  various  thicknesses   (0.010  to  0.031   In.) 
were  placed  around  two  of  the  Joints  according  to  gap  width  available 
(with  some  exceptions).     No  leaks  were  apparent  during  the  test;  however, 
the  cavity  pressure  measurement  on  clevis  Joint  number  5  (see  enclosure  4) 
showed  peculiar  behavior  (negative  pressure  to  *8.3  pslg).     Calculations 
performed  by  MSFC  and  agreed  to  by  Thiokol   show  that  distortion  of  the 
clevis  Joint  tang  for  any  Joint  can  be  sufficient  to  cause  0-Hng/tang 
separation.     Data  from  OM-1   shows   that  this  condition  can  be  created  by 
Joint  movement  (lowering  of  support  chocks)  and  data  from  the  hydroburst 
test  shows   the  tang  and  clevis  dn  not  remain  concentric  during  pressure 
cycling.     All   situations  which  could  create  tang  distortion  are  not  known, 
nor  Is   the  magnitude  of  movement  known.     Regardless  of  these  unknowns,  Thiokol 
then  proposed  to  use  a  standard  0.020  inch  thick  shlo  for  all   SRM  clevis 
Joints   Including  the  STA-1   vehicle   (see  enclosure  5).     Subsequent  to  arrival 
of  the  STA-1   vehicle  at  MSFC,  Structures  and  Propulsion  Laboratory  was  asked 
to  assess  the  adequacy  of  the  0.020  inch  shims  which  had  been  Installed  by 
Tilokol.     The  response,  documented  by  r>e«orindum  EP01    (77-252)   (see  enclosure 
5)   recommended  shim  sizes  ranging   fi~jm  0.031   inch   to  0.046  inch  chic*   In 
order  to  maintain   the  Industry  recommended  minlrrua  ccmoression  value  of  15 
percent.      It  was,  and  still   1s.  our  desire  to  test  with  IS  percent  minimum 
compression  since  this  value  is   the  industry  wide  elnimum  and  was  original  1/ 
the  minimum  design  value  used  by  Thiokol   prior  to  the  tang  distortion  problem. 

After  issuance  of  the  Structures  and  Propulsion  Laboratory  recommenda- 
ti'jns,  li  ;Z51  excision  ia>  rjde  to  usa  a  3.015  Inch  tnlc>.  :Mn  In  the  field 
Joint  of  STA-1  i.nleh  results  in  i  siataoa  ccr-;re;:lcn  viiw*  of  ^iroxlia-ily 
5.5  percent.  This  value  assuces  no  compression  set.  V;  »tro-vgly  objecc  to 
this  proposal  because  it  creates  unacceptable  risks  which  can  aad  should  be 
avoided. 


This  memorandum,  written  by  Leon  Ray  and  signed  by  John 
Q.  Miller,  strongly  urged  that  the  clevis  joint  be  redesigned. 
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Calculations  conducted  by   this  office  show  that  In  some   Instances,  O-rlng 
compression  on   flight  vehicles  has   the  potential   of  being  negative  by 
approximate!/  1,5  percent;   these  calculations   Included  the  effect  of  0-i  Ing 
compression  set.     Thlokol   test  report  dated  August  15,  1977,  per  TVR-11507. 
"0-rlng  repair  verification  test  plan"   (see  enclosure  7)  shows  that  the 
parent  0-rlng  material   and  splice  Joints   exhibited  maximum  compression  sets 
of  5.8  and  7.0  percent,  respectively.     Also,  when  considering  that  the  SRM 
process  demonstration  segment  0-rlng  suffered  a  compression  set  value  of 
approximately  11.0  percent,  one  must  treat  these  values  as  realistic  and 
Include  their  effects  when  calculating  0-rlng  compression.      It  Is  recognized 
that  0-r1ngs  will  perform  properly  at  lower  values   than  the  15  to  25  percent 
range  recommended;   however,   the  higher  values  are  used  as  a  design  point  In- 
order  to  account   for  losses   Such  as  0-rlng  compression  set  and  defects   In 
the  hardware  sealing  surfaces   and  0-r1ngs.     Our  recommendations  to  redesign 
on-coming  hardware  and  custom  shim  each  Joint  (with  a   range)  on  existing 
hardware  as  presented  to  you   In  October  1977,   Is   still   valid   (see  enclosure  8) 
The   following  recommendations  and  Justifications  are  consloered  mandatory  to 
provide  adequate  clevis  Joint  sealing  on  all  SRMs. 


compression  value  of  15  percent 


(1)  Reshln  STA-1   to  obtain  a  alnla 
In  order  to  verify  the  design  for  flight. 

(2)  Redesign  clevis  Joints  on  all  on-coving  hardware  it  the  earliest 

possible  tffectlvlty  to  preclude  unacceptable,  high  risk,  0-r1ng  compression 
values.     This  will  eventually  negate  the  use  of  shins,  thereby  reducing 
assembly  tine  and  eliminating  shimming  errors. 

(3)  Continue  to  use  shins  with  existing  and  arlxed  hardware.     Shies 
should  bt  of  sufficient  thickness  to  provide  a  alnlnura  0-rlng  compression 
of  15  percent,     This  value  1s  used  and  recommended  by  Parker,  Precision. 

CSO  (Titan),  Aerojet,  and  MSFC  Science  and  Engineering  Laboratories.     We)  know 
of  no  Instance  where  lower  values  are  recommended. 

(4)  Direct  the  prime  contractor  and  booster  assembly  contractor  to 
reinstate  the  design  requirements  of  15  to  25  percent  compression  for  clevis 
Joint  0-rlhgs.     '.1e  see  no  valid  reason   for  not  designing  to  accepted  standards 

In  summary,  hi  believe  that  the   facts  presented  In  the  preceding  paragraphs 
should  receive  your  most  urgent  attention.     Proper  shin  sizing  and  high 
quality  0-rlngs  are  mandatory  to  prevent  hot  gas  leaks  and  resulting 
catastrophic  failure.     Ue  will  be  pleased  to  provide  assistance  In  any  way 
possible. 


Questions  concerning  the  contents  of  this 
Mr.  W.  L.  Ray,  3-0459, 

/.John  0.  Miller 
Chief,  Solid  Motor  Branch 

8  Enclosures 

cc:  w/o  enc. 
EPOl/Hr.   McCool 
EP41/Hr.   Hopson 
EP21/NV.  Lorabardo 


orandun  should  be  referred  to 
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National  Aeronautics  and  f\  I  /\  ^m  fk 

Space  Admmistralion  iM/A^^/A 

George  C.  Marshall  Space  Right  Center 

Marshall  Space  Flight  Center,  Alabama 
35812 


EP25   (79-13)  January  19,   1979 

TO:  EE51/Mr.    Eudy 

FROM:  EP25/Mr.   Miller 

SUBJECT:        Evaluation  of  SRM  Clevis  Joint  Behavior 


As   requested  by  your  memorandum,   EE51    (79-10),   Thiokol   documents 
TWR-12019  and   letter  7000/ED-78-484  have  been   revaluated.     We  find 
the  Thiokol   position  regarding  design  adequacy  of  the  clevis  joint 
to  be  completely  unacceptable  for  the  following  reasons: 

a.  The  large  sealing  surface  gap  created  by  excessive  tang/clevis 
relative  movement  causes   the  primary  0-ring  seal   to  extrude  into  the 
gap,   forcing  the  seal   to  function  in  a  way  which  violates   industry  and 
Government  0-ring  application  practices. 

b.  Excessive  tang/clevis  movement  as  explained  above  also  allows 
the  secondary  0-ring  seal    to  become  completely  disengaged   from  its 
sealing  surface  on  the  tang. 

c.  Contract  End  Item  Specification,  CPW1-2500D,   page   1-28,   paragraph 
3.2.1.2   requires   that  the  integrity  of  all   high  pressure  case  seals  be 
verifiable;    the  clevis  joint  secondary  0-ring   seal    has   been  verified 

by   tests   to  be  unsatisfactory. 

Questions  or  comments  concerning   this  memorandum  should  be  referred  to 
Mr.   William  L.   Ray,   3-0459. 

/John  Q.   Miller 
Chief,   Solid  Motor  Branch 

SA41/Messrs.    Hurdy/Rice 

EE51/Mr.  Uptagrafft 

EH02/Mr.  Key 

EPOl/Mr.  McCool 

EP42/Mr.  Bianca 

EP21/Mr.  Lombardo 

EP25/Mr.  Powers 

EP25/Mr.  Ray 


This  memorandum,  also  written  by  Leon  Ray  and  signed  by 
John  Q.  Miller,  strongly  questions  the  clevis  joint  design  It  is 
the  earliest  known  official  document  which  questions  the 
redundancy  of  the  seal. 
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National  Aeronautics  and 
Space  Administration 

George  C.  Marshall  Space  Rlghl  Center 
Marshall  Space  Flight  Center,  Alabama 
35812 


#. 


<±  S~s 


NASA 


Rap** Mm <*  EP25   (79-23) 


February  6,  1979 


TO:       Distribution 

FROM:     EP25/Mr.  Ray 

SUBJECT:   Visit  to  Precision  Rubber  Products  Corporation  and 
Parker  Seal  Company 


The  purpose  of  this  memorandum  is  to  document  the  results  of  a  visit 
to  Precision  Rubber  Products  Corporation,  Lebanon,  TN,  by  Mr.  Eudy,  EE51  and 
Mr.  Ray,  EP25,  on  February  1,  1979  and  also  to  inform  you  of  the  visit 
made  to  Parker  Seal  Company,  Lexington,  KY  on  February  2,  1979  by  Mr.  Ray. 
The  purpose  of  the  visits  was  to  present  the  0-ring  seal  manufacturers 
with  data  concerning  the  large  0-ring  extrusion  gaps  being  experienced  on 
the  Space  Shuttle  Soli*  Rocket  Motor  clevis  joints  and  to  seek  opinions 
regarding  potential  risks  involved. 

The  visit  on  February  1,  1979,  to  Precision  Rubber  Products  Corporation 
by  Mr.  Eudy  and  Mr.  Ray  was  very  well  received.  Company  officials,  Mr. 
Howard  Gillette,  Vice  President  for  Technical  Direction,  Mr.  John  Hoover, 
Vice  President  for  Engineering, and  Mr.  Gene  Hale,  Design  Engineer 
attended  the  meeting  and  were  presented  with  the  SRM  clevis  joint  seal 
test  data  by  Mr.  Eudy  and  Mr.  Ray.  After  considerable  discussion, 
company  representatives  declined  to  make  immediate  recommendations  because 
of  the  need  for  more  time  to  study  the  data.  They  did;  however,  voice 
concern  for  the  design, stating  that  the  SRM  0-ring  extrusion  gap  was 
larger  than  that  covered  by  their  experience.  They  also  stated  that  more 
tests  should  be  performed  with  the  present  design.  Mr.  Hoover  promised 
to  contact  MSFC  for  further  discussions  within  a  few  days.  Mr.- Gillette 
provided  Mr.  Eudy  and  Mr.  Ray  with  the  names  of  two  consultants  who  may 
be  able  to  help.  We  are  indebted  to  the  Precision  Rubber  Products 
Corporation  for  the  time  and  effort  being 'expended  by  their  people  in 
support  of  this  problem,  especially  since  they  have  no  connection  with 
the  project. 

The  visit  to  the  Parker  Seal  Company  on  February  2,  1979,  by  Mr.  Ray, 
EP25,  was  also  well  received;  Parker  Seal  Company  supplies  the  0-rings 
used  in  the  SRM  clevis  joint  design.  Parker  representatives,  Mr.  Bill 
Collins,  Vice  President  for  Sales,  Mr.  W.  B.  Green,  Manager  for  Technical 
Services,  Mr.  J.  W.  Kosty,  Chief  Development  Engineer  for  R&D,  Mr. 
D.  P.  Thalman,  Territory  Manager  and  Mr.  Dutch  Haddock,  Technical 
Services,  met  with  Mr.  Ray,  EP25,  and  were  provided  with  the  identical 


pagel 


This  Leon  Ray  memorandum  documents  his  visits  to  two 
0-rmg  manufacturers,  both  of  whom  expressed  concern 
relative  to  the  0-ring  performing  properly  in  the  joint  design. 
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SRM  clevis  joint  data  as  was  presented  to  the  Precision  Rubber  Products 
Company  on  February  1,  1979.  Reaction  to  the  data  by  Parker  officials 
was  essentially  the  same  as  that  by  Precision;  the  SRM  0-ring  extrusion 
gap  is  larger  than  they  have  previously  experienced.  They  also  expressed 
surprise  that  the  seal  had  performed  so  well  in  the  present  application. 
Parker  experts  would  make  no  official  statements  concerning  reliability 
and  potential  risk  factors  associated  with  the  present  design;  however, 
their  first  thought  was  that  the  0-ring  was  being  asked  to  perform  beyond 
Its  intended  design  and  that  a  different  type  of  seal  should  be  considered. 
The  need  for  additional  testing  of  the  present  design  was  also  discussed 
and  it  was  agreed  that  tests  which  more  closely  simulate  actual  conditions 
should  be  done.  Parker  officials  will  study  the  data  in  more  detail  with 
other  Company  experts  and  contact  MSFC  for  further  discussions  in 
approximately  one  week.  Parker  Seal  has  shown  a  serious  interest  in 
assisting  MSFC  with  this  problem  and  their  efforts  are  very   much  appreciated. 


l&jU&a+i. 


William  L.  Ray 

Solid  Motor  Branch,  EP25 


Distribution: 
SA41 /Messrs.  Hardy/Rice 
EE51/Mr.  Eudy 
EPOl/Mr.  McCool 
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Documents  relating  to  the  change  from  Criticality  1R  to  1,  and  the  waiver  of  the 
redundancy  requirements  for  the  Solid  Rocket  Motor  seal 


<"    .Jl     T  ' 


SRB   CRITICAL   ITEMS   LIST 


Sh«f!,l of     2 


CS7- 


'a/  SCfitf  4\7   <&#=. 


Cm/tilirv  Cjujorv       -"       *u:uon  fn  .  to   aec. 


solid  =icc.<rr  %tor 


10-01-01 


"Case.  P/M  i'J;0129 .  1US0131,  1U50120.  1U50159,  1U50135 , 
.,,„,  ,„.,.  1U51473  [Joint  Assys  ■  rectory  P/N  1^1753.  rleid:  lUSQTgJ) 


?igi 


1  (11  segments) 


"ovember  24.  1980 


FSEA  Pjp  No.. 

Critical  PHbk 


A-4     of  ?.SrC-»PT-724 


Hoskins 


.,''•/- 


:anuft  Moot  S  Ciuser       Leakage  at  case  assembly  joints  due  to  redundant  O-ring  seal    failures  or  primary  seal   and 
leak  check  port  0-ring  failure. 


?ii:<jn>  c;fec:  Summjrv      Actual   Loss   -  Lass  of  mission,  venicie,  and  crew  due  to  metal   erosion,  burnthrougn,  and 
prooable  case  burst  resulting  in  fire  and  deflagration. 


^ecjncircY  Sc^tnj  &  T.'"uurt'meno 

11    Fail   -  Leak  test  does  not  verify  integrity  of  leak  cieck  port  seal. 

2)  Fail   -  Not  tested. 

3)  Pass   -  No  known  credible  causes. 


RATIONALE  rOR  RETENTION 


A.     QESIGK 

-  Each  0-ring  of  the  redundant  pair  is  designed  to  effect  a  seal.     The  design  is  based  upon  similar  single 
seal  Joints  used  in  previous  large  diameter,  segmented  motor  cases. 

A  small  MS  port  leading  to  the  annular  cavity  between  the  redundant  seals  permits  a  leak  check  of  the  seals 
immediately  after  joining  segments.     The  ,1S  plug,  installed  after  leak  test,  has  a  retaining  groove  and 
compression  face  for  its  0-ring  seal.     A  means  to  test  the  seal  of  the  installed  HS  plug  has  not  been  established 

The  surface  finish  requirement  for  the  0-ring  grooves   is  63  and  the  finish  of  the  0-ring  contacting 
portion  of  the  tang,  which  slides  across  the  0-ring  during  Joint  assembly,   is  32.     The  joint  design  provides 
an  00  for  the  0-ring  installation,  which  facilitates  retention  during  Joint  assembly.     The  entry  portion  of 
the  tang  proviaes  0.125-inch  standoff  from  the  0-rings  contact  portion  of  the  tang  during  Joint  assembly.     The 
design  drawing  specifies  0-r1ng  lubricant  prior  to  the  installation.     The  factory  assembled  joints  (dwg.  1U51763) 
have  an  additional  seal  provided  by  the  subsequently  applied  internal   case  insulation. 

The  field  assembled  Joints   (Dwg.  1US0747)  and  factory  assembled  joints  (Dwg.  1U51768)  benefit  frcm  the 
Increased  0-ring  compression  resulting  from  the  centering  effect  of  shims   of   .032-. 036-  inches  between  the 
tang  O.D.  and  clevis   1.0.  of  the  case  joint.     However,  redundancy  of  the  secondary  field  joint  seal  cannot  be 
verified  after  motor  case  pressure  reaches   approximately  401  of  MSGP.      It   is  known  that  Jo.lnt  rotation 
occurring  at  this  pressure  level  with  a  resulting  enlarged  extrusion  gap  causes   the  secondary  0-ring  to  lose 
compression  as   a  seal.   "It  1s  not  known  if  the  secondary  0-ring  would  successfully  re-seal    if  the  primary  0-ring 
should  fail  after  motor  case  pressure  reaches  or  exceeds  405  ME0P. 

The  0-ring   for  the  case  joint  and   test  oort  ere  mold  formed  of  high  temperature,  comoresslon  set 
resistant,   fluorocaroon  elastomer.     The  design  permits   five  scarf  joints   for  the  case  joint  sael.     ~ne 
0-ring  joint  strength  must  equal   or  exceed  40;  of  the  parent  material    strength. 


3. 


testing 


A  -*ull   scale  clevis  Joint  test  verified  the  structural   strength  of  the  case  and  pins   (7*R-1C547).     A 
hydroburst  life  cycle  test  (?<;R-11S64)  demonstrated  the  primary  seal's  ability  to  withstand  -pur  tires  the 
flight  requirement  of  one  pressurization  cycle  and   the  secondary  seal's   ability  to   continue   :o  seal    jncer 
reseated  cycling  (:4  cycles)  with  the  primary  seal   failed.     The  joint  seals  withstood  ultimate  tressure  of 
1432  :si   aurlng'the  ^urst  tests,  yielding  a  safety   factor  of  :.;3.     The  Structural    Test  Article   (STA-1 ) 
verified  the  seals  capability  under  flight  leads  and  further  verified  the  redundancy  of  the  sectr.dary  seal. 

The  Joint  seals  have  performed  successfully  In  four  developmental   and  three  oual'ficatipn  rptor  static 
firings. 
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This  original  Critical  Items  List  entry  for  the  Solid  Rocket  Motor 
case  joint  seals  establishes  them  as  Criticality  1 R  (redundant). 
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SRB    CRITICAL    ITEMS    LIST  =-...2 


£j;r/:;fm: 


M070R 


3 


'0.,-n.3; A/n 

t,  ?/:<  1U50129,  iu=oi3i,  ;u=oi30,  nsois9.  nsoiss. 


"Zim,  '■-<  :.::::?.  :-:Ci:i.  ;u50i30.  ilsoi69. 

,r-  \ir-;.    ^;:-7j    'Joint   Assys.    rac'.orv,    ?/H    l'JS1768.    field:    ll'S0747)  I      s?vuion: 


RATIONALE  FOR  RETENTION  ICONrC! 


The  tang  -A-  dia.  and  clevis  -C-  d1a.  are  measured  and  recorded.  These  diameters  control  the  radia 
soacing  between  tanc  and  clevis.  The  depth,  width  and  surface  finish  of  the  0-r1ng  grooves  are  veHfie 
The  secr.ent  finish  of  the  tang  1s  also  verified.  The  0-ring  seal  mating  surfaces  of  the  forward  and  af 
secnents   are  verified  for  flatness   and  surface  finish.     The  following  characteristics   are   inspected  on 

A     ■!■■     *<*     >  p  r  i  .V>a     ^«n»«F-r»  nr-m     t«     ?Ki     ct>nri»  r**C 


A  lightweight  case  joint  verification  test  (TUR-12590)  has  demonstrated  the  secondary  seal  performance 
with  a  purposely  pre-failed  primary  0-ring  and  demonstrated  three  pressure  cycles  on  the  primary  seal  with 
or.e  cycle  to   l.*0  times  majtimum  expected  operating  pressure. 

C.      INSPECTION 

The  *anq  -A-  dia.   and  clevis   -C-  dla.   are  measured  and  recorded.     These  diameters   control    the   radial 

"ied. 
ft 

each 
0-ring  to  assure  conformance  to  the  standards. 

o  Surface  voids  and  Inclusions 

o  *old  flashing 

o  Scarf  joint  mismatch  or  separation 

o  Cross   section 

o  Circrrference 

Each  assembled  Joint  seal    is   tested  per  STJ7-2747  vie  pressurizing  the  annular  cavity  between  seals   to 
=0=5  ps1   end  monitoring  for  10  minutes.     A  seal   seating  pressure  of  220  psi ,  with  return  to  0  pslg,  may 
be  used  prior  to  the  test.     A  pressure  decay  of  1  psig  or  greater  is   not  acceptable.     Following  seal   verification 
by  QC,   the  leak   test  port  plug   Is   installed  with  QC  verifying   installation  and  torquing. 

0.      FAILURE  HISTORY 

No  known  record  of  failure  due   to  case  joint  seal    leakage  on  segmented  156"  or  Titan  1 1 IC  rotors. 

No  failures   1n  the  four  development  and  three  qualification  SRH  motor  test  firings. 


page  2 


240 


SRB  CRITICAL   ITEMS  LIST 


Shtt:      1 o'      1 


SOLID  ROCKET  BOOSTER 


Cfiicjlirv  Cjttgory 


irnneaiate 
,  RfiClion  Lmt    to    Sec. 


10-01-01 


•Case,  P/N  (See  Retention  Rationale) 
Stm (Joint  Assys.  Factory  P/N  1U50147  Field:  1U50747 


"vfi 


A-6A 


fltvwon 


Sj  'Kuirtd     1    (11    segment.    3   Field    lolnts.    7  olant    mints) 
'MEA  **,,  No  A-4  of  HSFC-RPT-724 


Out    DecemOer   17.    1982 


Antiyn  Garfeer 


Cni.ciiPMwi    Boost 


^Ur^i^L 


:n'uri  Moa< &  Cium      Leakage  at  case  assembly  Joints  due  to  redundant  0-r1ng   seal   failures  or  primary   seal   and 
leak  check  port  0-r1ng  failure. 

NOTE:     Leakage  of  the  primary  0-r1ng  seal    1j  classified  as  a  single  failure  point  due  to  possibility  of  loss  of 
seaTlng  at  the  secondary  0-r1ng  because  of  joint  rotation  after  motor  pressuHzatlon. 


f niurt  EftKi  Summ»rv       Actual  Loss  -  Loss  of  mission,  vehicle,  and  crew  due  to  metal  erosion,  burnthrough,  and 
probable  case  burst  resulting  In  fire  and  deflagration. 


RATIONALE  FOR  RETENTION 


Case,  P/N  1U50129,   1U50131.   1U50130,   1U5018S.  4US01«73i   1U50715,   1US0716,   1US0717 

SO£W7i 

A.  DESIGN 

The  SRH  case  Joint  design  1s  comon  1n  the  lightweight  and  regular  weight  cases  having  Identical  dimensions. 
The  SRH  Joint  uses  centering  clips  which  are  Installed  1n  the  gap  between  the  tang  0.0.  and  the  outside 
clevis  leg  to  compensate  for  the  loss  of  concentricity  due  to  gathering  and  to  reduce  the  total  clevis  gap 
which  has  been  provided  for  ease  of  assembly.     On  the  shuttle  SRH,  the  secondary  0-rtng  was  designed  to 
provide  redundancy  and  to  permit  a  leak  check,  ensuring  proper  Installation  of  the  0-r1ngs.     Full   redundancy 
exists  at  the  moment  of  Initial   pressuHzatlon.     However,  test  data  shows  that  a  phenomenon  called  Joint 
rotation  occurs  as  the  pressure  rises,  opening  up  the  0-r1ng  extrusion  gap  and  permitting  the  energized 
0-r1ng  to  protrude  Into  the  gap.     This  condition  has  been  shown  by  test  to  be  well  within  that  required  for 
safe  primary  0-r1ng  sealing.     This  gap  may,  however,  1n  some  cases,  Increase  sufficiently  to  cause  the  un- 
energlzed  secondary  0-r1ng  seal   to  lose  compression,  raising  question  as  to  Its  ability  to  energize  and 
seal   If  called  upon  to  do  so  by  primary  seal   failure.     Since,  under  this  latter  condition  only  the  single 
0-ring  Is  sealing,  a  rationale  for  retention  1s  provided  for  the  simplex  mode  where  only  one  0-r1ng  Is 
acting. 

The  surface  finish  requirement  for  the  0-r1ng  grooves   1s  63  and  the  finish  of  the  0-r1ng  contacting  portion 
of  the  tang,  which  slides  across  the  0-r1ng  during  Joint  assembly,  1s  32.     The  Joint  design  provides  an  00 
for  the  0-r1ng  Installation,  which  facilitates  retention  during  Joint  assembly.     The  tang  has  a  large  shallow 
angle  chamfer  on  the  tip  to  prevent  the  cutting  of  the  0-r1ng  at  assembly.     The  design  drawlno  specifies 
application  of  0-ring  lubricant  prior  to  the  Installation.     The  factory  assembled  joints  have  NBR  rubber 
material  vulcanized  across  the  Internal  Joint  faying  surfaces  as  a  part  of  the  case  Internal    Insulation 
subsystem. 

A  small  MS  port  leading  to  the  annular  cavity  between  the  redundant  seals  permits  a  leak  check  of  the  seals 
fntnedlately  after  Jotning  segments.     The  MS  plus.  Installed  after  leak  test,  has  a  retaining  groove  and 
compression  face  for  Its  0-ring  seal.     A  means  to  test  the  seal  of  the  Installed  MS  plug  has  not  been 
established.  q 

or 

The  0-r1ngs  for  the  case  joints  are  mold  formed  and  ground  to  close/ tolerance  and  the  0-r1ngs  for  the  test 
port  are  mold  formed  to  net  dimensions.     Both  0-r1ngs  are  made  -fe**h1gh  temperature,  low  compression  set 
fluorocarbon  elastoner.     The  design  permits  five  scarf  Joints  for  the  case  Joint  seal  rings.     The  0-r1ng 
Joint  strength  must  equal  or  exceed  401  of  the  parent  material   strength. 

B.  TESTING 


To  date,  eight  static  firings  and  five  flights  have  resulted  1n  180  (54  field  and  12S  factory)  Joints 
tested  with  no  evidence  of  leakage.  The  Titan  III  program  using  a  similar  Joint  concept  has  tested  a 
of  1076  Joints  successfully. 


total 
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In  late  1982,  Marshall  Safety,  Reliability  and  Quality  Assurance 
engineers  reviewed  test  and  analysis  results  and  determined 
that  the  case  joints  should  be  reclassified  as  Criticality  1  (not 
redundant).  This  form  was  signed  by  Maurice  (Bud)  Parker,  a 
local  Thiokol  Reliability  engineer,  beginning  the  process  of 
management  approval  of  the  Criticality  change. 
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SKB   CRITICAL   ITEMS   LIS1 


•>- JL-JL 


Sybirntffl  SOLID  PQC*n  jjjjjjjjj 


C'lfoJiry  GiUforv I 


|nr<td1lte      4tf< 
•i«cro"  Time    tn   S»r 


10-01-01 


•Case,  P/N   (Set   Retention  Rationale) 
(Joint  Anvs.   Fictarv  P/H  lL'SiyW  f leld-L 


man 


RATIONALE  POP.  RETENTION  (CONTOI 


A  leboretory  tilt  progrtti  demonstrated  the  ability  of  tht  0-rlngto  operate  successfully  when  extruded 
Into  saps  will  o»tr  those  encountered  In  thli  0-rlng  application.     Unlfom  gaos  of  1/8-Inch  ind  ovtr  (TVS- 
13486)  successfully  withstood  pressures  of  1600  pil.     The  Hydroburit  Progree»  (TVR-U664)  ind  the  Structural 
Test  Prograt)   (ST*- 1)   for  tht  standard  weight  cast   (TVR-12051)  ind  tht  lightweight  Cut  Joint  Ctrtlflcltlon 
Ttft  (TVR-128Z9)   ill   have  shown  that  tht  0-r1ng  cin  withstand  t  alnlaua  of  four  pretiUTiiatlont  brfort  damage 
to  tht   ring  can  peralt  my   leakagt. 

Further  demonstration  of  tht  capability  of  Joint  statin)  1s  found  In  tht  hydro-proof  ttstlns  of  new  and 
refurbished  cast  segments.     Ovtr  540  Joints  havt  bttn  exposed  to  liquid  pr*ssur1zatlons  at   ir>t)s 
txctedlng  motor  HOP  with  no  leakage  experienced  past  tht  pHrary  0-rlnj.     Tht  only  occasions  whtrt  leakage 
was  txptrltnctd  was  during  refurbishment  of  STS-1  whtrt  two  stlfftntr  iiy—nts  were  severely  damaged  during 
cavity  collapse  at  attar  Impact. 

A  more  dttallad  dtscrlptlon  of  SW  Joint  ttstlng  history  Is  contained  In  TWH-13520.  Revision  A. 

C.     IHSPECT1QH 

Tht  tang  -A-  dltmtttr  and  clavls  -C-  diameter  art  measured  and  rteordtd.     Tht  depth,  width  and  surfaet 

finish  of  tht  0-rlngs  groovts  art  verlfltd.     Tht  surfaet  finish  of  tha  tana  1s  also  varlfltd.     Charactarl sties 

art  Insptcttd  on  tach  0-rlng  to  assure  conformance  to  tht  standards  to  include- 

o  Surfaet  conditions 

0  Hold   flashing 

o  Scarf  Joint  alsaatch  or  separation 

0  Cross   section 

o  Clreuirfertnea 

o  Durontttr 

Each  assembled  Joint  stal   Is  tested  per  STV7-2747  fit  pressurising  tht  annular  cavity  betwttn  sttls  to  SO  t 
5  ps!  and  monitoring  for  10  alnutts.     A  pressure  dtcay  of  1  pi  1 g  or  greater  Is  not  acceptable.     Following 
seal  verification  by  QC,  tht  Itak  test  port  plug  la   Installed  with  QC  verifying  Installation  and  torqulng. 

0.     FAILURE  HISTORY 

No  failures  havt  been  experienced  1n  tht  static  firing  of  three  qualification  rotors,  five  dtvtlopmtnt 

no  tors  and  ten  flight  rotors. 
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""MlifiO-H*! 


t ■  I  '■". 

ELt'-tlO 


r»0ti>'M  CONTKOL  "O.I 

77761 


3RE   LEVEL    111 


>.   MlPflMiBit  ifJb'iv)bJAL<i)/B>ieAKliiA<iONH')T 

W.   Trewh1tt/EL54    |t>/-"f 


1-21-63 


r  r.ci 
1 


CMANCl    riTLtl 

SRB  and  RSCD  System  CIL 
:henpe  Notice  No.  23 


UNDER  THE  AUTHORITY  O F CHANGE  OROFft    .?<^9        r. 
CONTRACT  NAS8-32OO0.  USBI  IS  HEREBY  AUTHORIZED 


TOINCORPO 
CHANGE 


■.  irrtCTiviTv. 


0  7  thru  A18  ;     STS-6 


SA43. 


MSFC-RPT-72S 


p^v€" 


Q 


Cn«NOe   Oi|»0»iHONi 


DOCUMENTATION   CHANGE" 


ECR  EL54- 01 41- Is- approved  with  changes 

a.  Page  A-6A"-  A.    DESIGN     -  frword  first  part  of  paragraph  1. 

b.  Page  A-6A"-  A.    DESIGN     -   Paragraph  4   reworded. 

c.  Page  A-6A  -  8.   TESTING  -   Paragraph  1    reworded^ 

d.  Pige  A-6B  -  B.   TESTING  -   Paragraph  1    reworded 

e.  Page  A-6B  -  C.    INSPECTION  -  Paragraph  1    reworded 

f.  Page  A-6B  -  0.   FAILURE  HISTORY  -   Delete  the   first  paragraph  tnd  reword  the  seconi 
paragraph. 

SA43/J.   N.   Strickland  shall   take  necessary  action  to   Inform  USBI   that  ECR  EL54-0141 
1s  approved  with  above  changes.  Due  Datei      2-fl-«3. 

E154/W.   Trey.'hUt  shall    submit  Change  Notice  No.    ?3  to  KSFC-RPT-725  through  EL65/ 
Release  Desk  to  M5FC  Repository.  Due  Date:     2-B-83 

EL54/W.    Trevhlrt    shall   prepare   •   Level   II   CR   end   SCRC  Action  Request   for   trantvlcttl 
via   SCr.C    to  Level  II   PRCB.      Due  Dete:      2-8-83. 

future   corrtkpendcnce   ahall    reference  PCIN   77761. 


57/tf 


<»>/».   Carum 


On  January  21,  1983,  the  Marshall  Configuration  Control 
Board,  chaired  by  Lawrence  Mulloy,  approved  the  change 
from  Criticality  1 R  to  Criticality  1  and  approved  it  for  forward- 
ing to  Level  II. 
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ICHAHCE   TITLE: 

I 

;    5"!   Critical     Item    List    ( CIL)    Requirements    for    SRM    Case    Joint    Ass 


;CH*KCl    PROPOSAL'S)    NO.     A»0   SOURCE 

I 

I    ;  .-.i     II   Chang*    Request    S22106L 


iDCcyn[NT3  affected  (»o. 
I 

I    JSC    07TO0.    tolum*    X 


TITLt.    PAR*) 


I  SUBMITTED   BT: 


1SFC-SA22''D.    Riley 
OPR'     LA'H 


t INITIATED  87:    HSFC-F.L5"/""-    Trewhltt 

ILEVEL    II    BASELINE   CHANGE    DIRECTION: 

i  PRCSD   S?2'C*L    Is    issued    to   authoMi*    submittal    of   Level    I   Change    Request 

I  H22106L   for    v*i**r  of   SRB  critical    failure  modes    which  do  not  meet    the    redundancy 

1  requirements    (paragraph    2.8).   of  th*    Space   Shuttle    Program    Requirements    Docuaient. 

[  Level    I.   dated    June    JO.    1977. 

;    Effectlvity:      STS-«   and    subs. 

I    Level    II    Impacts   euthorlxed    by  this  dlr 

I 

!    ACTIONS: 


JSC-Lf:    11-1) 


Subsequent    to    Level    I   approval    of    Change    Request    H22106L. 
revise    PRCBD   S22106L   to    authorlic    implementation    and    update 
of   JSC   07700.    Volume   X. 


Action  due: 
Category    II 


Level    I   approved    Change 


I 

! 

I  'This    PRC8C  was    processed   outside    th*    formal    L*v«l    II    PRCB.      In    th*    *v*nt    •  discr«pancy 

1  or    Impact    is    identified.    Implement at  ion   of   this  change    shall    b*   held    in    abeyance    pending 

I  further   disposition   by  the    Level    II    PRCB.      Such  discrepancies   and/or    impacts    ihall    be 

t  Immediately    Identified    to   the    Level    II    PRCB   Secretary  and    submitted    on    a    Level    II 

I  Change    Request    for   appropriate    action    within   60  days   after    approval    of   this  directive. 

; AUTHORIZATION: 


&i 


OUJ*KA«.    LEVtl    [I    M 
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SPICE   TRANSPORTATION   3TSTEM 

LETEL    I 

CHARGE    REQUEST 


SRB  Critical    Item*  List   (CIL)    Requirements 


/    /  System    Software 

/    /  Cre— Related    CM 

/    f  Shuttle    Carrier    A. 

/    /  I  US 

/    /  3peoeleb 


| 

ISrSTEH/ELEWERTtS)    AFPECTID: 

|        /  /    Shuttle   System 

I        /  /  Orblter 

I        /   /    Spaoe   Shuttle   Main    Engln 

I        /   /    External    Tank 

I        /X/   Solid    Rocket    Booater 

I        /   /  Launch   and    Landing 

■  •.—-•    Of       IAI    '  f  t   "mi 

I 

I  This  change   Identifies  Crlticallty   i  critical    items  which 

!  requirements  of   Paragraph   2.8  of  tha    Space    Shuttle    Progrm 

I  Laval    I.    dated    June    30.    1977.      These)   critical    items  oonta 

t  were    prevtouely   approved    Crlticallty    1R   by    Level     II    Chang. 

1  being    reclassified    Crltloallty    1. 

I  3UB3T3TE*    -    SOLID   ROCgT   HOTQg 

I 


etory 


Improvement 


Poyloeda 

Operations 
Othe«-t  Specify* 


o  not  meet    tM    fall    sere 

Requirements    Document , 

3   new  Items  and    5    items 
Request    SO2104C  ana    are   > 


itrl. 


IRECCHXENDCD   EFFECTiyiTT: 


IWIGHT    IHPACT: 


Subsystem  -  El* 
ITEM  NUHBEB 
1U5CI29 
1U501 30 
1U50131 
1051*73 
1U50185 
1U50715 
1U50718 
11/50717 

ST3-6    and    subs 

1  SCHEDULE    IMPACT: 


al    and    In  at  rumen  tat  to 
TftM 

Cm 


Fhea  up. 

t0-0<-01 
10-01-01 
10-01-01 

10-01-01 

10-01-01 
10-01-01 

10-01-0! 
10-01-01 


JCOST    PER   'LIGHT    IHPACT: 


I  COST 

IDDTaE 
I  PROD. 


I  REMAINDER 


IREASON   FOR    CHANCE: 

t  Critical  Items  which  do  not  meet  Level  I  fail-safe  requirements  require  submit 
I  NASA  Headquarters  letter  HHR-7  dated  February  21,  1979.  which  states  that  all 
I    Level    I  redundancy  requirements  b*    submitted    to    tha    Le«*l    I    P*XB   Tor   review  an 

JFOIWARDINC   AUTHORIZATION 

I      I      Space    Shuttle 

)    /   /  Othar(Spaclfy)        PRCBD  32Z1Q6L    I 


m 


I   I   ACTIOI 
«p  pro.nl 

Appro. td   tflth    Rv.lsto 
3«t    Pl|t«     


After  receiving  written  concurrence  from  certain  Johnson 
organizations,  Glynn  Lunney,  the  Shuttle  Program  Manager, 
approved  the  Criticality  change,  based  on  a  telephone  con- 
versation with  Lawrence  Mulloy,  the  Solid  Rocket  Booster 
Project  Manager.  This  action  was  taken  without  convening  a 
meeting  of  the  Program  Requirements  Control  Board.  This  ac- 
tion authorized  submittal  of  a  waiver  of  the  "fail-safe"  design 
requirement  to  Level  I. 


Glynn  Lunney  signed  this  request  for  Level  I  to  approve  for  the 
field  joint  a  waiver  of  the  "fail-safe  requirement"  for  Shuttle  com- 
ponents, in  that  the  joint  had  been  reclassified  as  Criticality  1 
(no  redundancy).  The  waiver  was  approved  for  Level  I  by  L. 
Michael  Weeks  on  March  28,  1983. 
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Memoranda  written  following  the  field  joint  O-ring  erosion 
on  STS41-B  (flight  10) 


!i!AS£L         Routing  Slip 

Mail  Code 

Name 

Action 

Approval 

TO:           EE01 

Mr.    Hardy 

Call  me 

Concurrence 

THRU:      EE11 

Mr.    Coates     ffjjCs 

File 

Information 

Investigate  and  Advise 

Note  and  Forward 

Note  and  Return 

Per  Request 

Per  Phone  Conversation 

Recommendation 

See  me 

Signature 

Circulate  and  Dtstrov 

SUBJECT:      Burned   O-Rings   on   STS-11 

The    recent    experience   of    two    burned   0-rings    (nozzie/case 
boss   and   forward/forward   center   joint)    on    STS-11    coupled 
with   the   "missing    putty"   finding   at   disassembly   raise 
concern  with  STS-13. 

Specifically  concern    is   raised   about    the   type   II   Randolph 
zinc   chromate   putty    (ZCP)    sensitivity    to   humidity  and 
temperature.      The    thermal    design   of    the   SRM  joints   depends 
on    thermal    protection   of    the   O-ring    by    the    ZCP.      ZCP 
failure   to  provide  a   thermal   barrier   can   lead    to   burning 
both  0-rings   and   subsequent    catastrophic   failure.    Adhe- 
sion  service- life  and    sensitivity   to    temperature  and 
humidity  of    the   type   II   ZCP  must   be   reassessed   and  veri- 
fied   in   the   light  of   rece.it   experience.      The   O-ring    leak 
check   procedure   and    its    potential    effect    on    the   ZCP 
installation   and    possible   displacement    is   also   an   urgent 

sSmVt^wm^"  " 

Mail  Code 

NW 

Action 

Approval 

Call  me 

Concurrence 

File 

Information 

Investigate  and  Advise 

Note  and  Forward 

Note  and  Return 

Per  Request 

Per  Phone  Conversation 

Recommendation 

See  me 

Signature 

— 

Circulate  and  DestrOY 

concern   which   requires    expedition   of    previously    identi- 
fied  fullscale    tests.      Effect   of    cavity   volume   size 
(cavity   between   the    ZCP   and    primary   O-ring)    on  O-ring 
damage   severity  must   also    be   assessed. 

Your    support    in    this   urgent   matter    is   requested. 

^y^X->r ■ 

JrJin  Q.    Miller 

Ctrlef,    Solid  Motor   Branch 

cc: 

EHOl/Mr.    Schwinghamer 
EH43/MX.    Hill.. 
SA41/Mr.   Mulloy 
SA42/Mr.   Wear 
EPOl/Mr.    McCool 
EP21/Mr.    McCarty 
KP?S/Mps<;r<;.     Powers/Ray 

Name 

John  Q.    Miller 

Tel.  No.  lor  Code)  &  Ext. 
453-3702 

Code  (or  other  designation! 

Da"     2/28/84 

NASA  FORM  26     JUN  78    PREVIOUS  EDITIONS  MAY  BE  USED 

This  internal  Marshall  note  was  written  by  John  Q.  Miller  after 
the  O-ring  erosion  experience  on  STS  41 -B  (flight  10),  in- 
dicating concern  that  the  leak  check  procedures  may  displace 
putty  ("blow-holes")  leading  to  O-ring  burning  ("erosion").  STS 
41  -B  was  the  first  flight  for  which  a  200  psi  leak  check  stabiliza- 
tion pressure  was  used. 
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UNITED 
TECHNOLOGIES 


84-3-9 


INTERNAL  CORRESPONDENCE 


To:  Larry  Mulloy 

Fm:  George  Morefield 

Sj:  Zinc  Chromate  Putty  in  SRM  Joints 

Dt:  March  9,   1984 

No:  GSM-0*2-84 


Fallowing  is  an  elaboration  of  my  impromptu  remarks  in  yesterday's  FRR  concerning 
burned  primary  pressure  vessel  "0"-rings. 

/  I  alluded  to  the  Titan  III  SRM  history  which  is  quite  similar  to  the  current  STS 
\L   I  ^M  experience.  Post-fire  inspection  of  Titan  SRM  static  test  motors  showed  that 
"7"C  I  pressurization  of  the  single  "0"-rings  in  the  pressure  vessel  routinely  occurred 

(  via  a  single  break-down  path  across  the  joint  putty.  There  was  also  evidence 

(that  some  "0"-rings  never  see  pressure  in  the  titan  motor.  The  segment-to-segment 
case  insulation  design  results  in  a  compression  butt  joint  which  apparently  is- often 
sufficient  to  withstand  P  . 
c 

It  should  be  pointed  out  that  single  point  pressurization  of  a  Titan  "0"-ring 
annulus  is  a  less  severe  event  than  on  an  STS  SRM  because,  being  a  smaller  diameter 
motor,  the  Titan  "0"-ring  plenum  has  less  volume  and  comes  to  pressure  equilibrium 
faster  (less  time  to  melt  the  "0"-ring). 

The  use  of  "lucky  putty"  has  alv/ays  been  surrounded  by  controversy.  Its  use  has 
become  a  given,  although  no  one  really  claims  it  to  be  part  of  either  the  insulation 
system  or  the  sealing  system.  In  fact  there  is  evidence  that  it's  use  can  cause 
oroblems  other  than  forcing  single-point  pressurization.  On  the  few  occasions 
when  Titan  motors  were  destacked  it  v/as  found  that  the  high  hydraulic  forces 
associated  with  joint  mating  actually  caused  case  insulation  to  peel  away  from  the 
case.  This  is  of  course  aggravated  by  the  pressure  of  the  hydraulic  medium,  putty, 
which  flows  into  the  separation  as  well  as  the  "0"-ring  plenum. 

Your  review  showed  that  there  v/as  sufficient  margin  of  "0"-ring  remaining  to  do 
the  job.   I'm  sure  you  have  considered  that  if  it  does  burn  through,  the  secondary 
"0"-ring  will  then  be  similarly  pressurized  through  a  single  port.  So,  some 
concern  remains. 


In  this  memorandum  to  Lawrence  Mulloy,  George  Morefield 
compares  the  Titan  joint  with  the  Shuttle  joint  and  assesses  a 
higher  failure  probability  for  the  Shuttle  joint,  indicating  con- 
cern that  putty  may  cause  "single  point  pressurization"  of  the 
primary  O-ring. 
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Pa  ns  2 
GSK-042-84 


I  recommend  that  you  set  up  a  panel  to  study  the  use  of  putty  and  consider 
some  alternatives: 

1)  Is  putty  needed  at  all? 

2)  If  the  tradition  can't  be  broken,  can  the  putty  be  applied  with 
multiple  (6  or  8)  pressurization  paths  built  in? 

I  think  that  the  primary  seal  should  be  allowed  to  work  in  its  classical  design 
node.  Both  the  Titan  and  STS  SRM's  have  been  designed  for  this  not  to  happen. 
Titan  has  flown  over  a  thousand  pressure  joints  with  no  failure.  My  opinion 
is  that  the  potential  for  failure  of  the  joint  is  higher  for  the  STS  SRM, 
especially  when  occasionally  the  secondary  seal  may  not  be  totally  effective. 


Chief  Engineer 


page  2 


Marshall  urgent  request  for  briefing  after  the  STS  51-C  mission  (flight  15) 


LARRY  WEAR 


Jat  Larry  Hulloy 
Poatmarkt  Jan  31,85    7t39  AN 
Status:   Certified  Urgent 
Subjects  51C  O-RING  EROSION  REi  51 E  FRR 


MESSAGE  DISPL 

TO   SANDY  COLEMAN 


Message i 

_£RR_B£SCOSSION  SHOULD  RECAP  ALL  INCIDENTS-OF—Q=RING— EROSION.  WHETHER 
NOZZLE  QFTcaSE  JOINT  AND-ALL.  INCIDENTS  WHERK-TB ERE-I-S  EVIDENCE  OF  FLOW 
gPAST  THE  PRIMARY  O-RING^.  ALSO,  THE  RATIONALE  USED  FOR  ACCEPTING  THE 
CONDITION  ON  THE""N07ZL~E  O-RING.   ALSO,  THE  MOST  PROBABLE  SCENARIO  AND 
LIMITING  MECHANISM  FOR  FLOW  PAST  THE  PRIMARY  ON  THE  51C  CASE  JOINTS. 
IF  MTI  DOES  NOT  HAVE  ALL  THIS  FOR_ TODAY  I  WOULD  LIKE  TO  SEE  THE  LOGIC 
ON  A  CHART  WITH  BLANKS  TBD. 


Following  the  discovery  of  the  STS  51-C  (flight  15)  O-ring  ero- 
sion and  blow-by,  Lawrence  Mulloy  sent  this  "Certified  Urgent" 
message  to  the  Solid  Rocket  Motor  manager,  Larry  Wear.  This 
message  was  passed  on  to  Thiokol  as  direction  to  prepare  a 
detailed  briefing  on  O-ring  problems  for  the  next  Flight 
Readiness  Review. 
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Internal  NASA  Headquarters  memorandum  after  visit  to  Marshall 


NASA 

Nrnmai  Atromutci  • 


JU.  IT  BB5 


TO:        M/Aitoctttt  Adalnlttrtter  for  Spice  Flight 

FROM:      MFS/Irr  Dividt 

SUBJECT:   Case  to  Cos*  ind  Nottlo  to  Co*o  "0"  Ring  Sool  Broolon 
Frobltas 

At  ■  remit  of  the  problttt  being  Incurred  during  flight  on  both 
case  to  case  and  noitle  to  caae  "0"  ring  erosion,  Mr.  Haabv  and  I 
visited  MSFC  on  July  11,  19IS,  to  discuss  this  Issue  with  both 
project  and  SIE  personnel.   Following  ir*  lose  laportont  factors 
concerning  these  probleas: 

A.   Rossi*  to  Case  "0"  ring  erosion 

There  here  been  twelve  (12)  instances  during  flight  where  there 
have  been  soae  prlatry  "0"  ring  erosion.   In  one  specific  cas* 
there  was  also  erosion  of  the  secondary  "0"  ring  seal.   There 
were  two  (2)  prlatry  "0"  ring  aeals  that  were  heat  affected  (no 
erosion)  and  two  (2)  casts  In  which  soot  blew  by  the  prlatry 
seals. 

The  prlae  suspect  as  the  cause  for  the  erosion  on  the  prlaary  "0" 
ring  seals  Is  the  type  of  putty  used.   It  Is  Thlokol's  position 
that  during  asseably,  leak  check,  or  Ignition,  a  hole  can  be 
foraed  through  the  putty  which  Initiates  "0"  ring  erosion  due  to 
a  jetting  effect.   It  Is  laportant  to  note  that  after  STS-10,  the 
aanufacturer  of  the  putty  went  out  of  business  and  a  new  putty 
aanufacturer  was  contracted.   The  new  putty  Is  believed  to  be 
aore  susceptible  to  envlronaental  affects  such  as  aolstura  which 
aakes  the  putty  aor*  tacky. 

There  are  various  options  being  considered  such  as  reaoval  of 
putty,  varying  the  putty  configuration  to  prevent  the  jetting 
effect,  use  of  a  putty  aade  by  a  Canadian  Manufacturer  which 
Includes  asbestos,  and  various  coablnatlon  of  putty  and  greaso. 
Theraal  analysis  and/or  tests  art  underway  to  assets  those 
options. 

Thlokol  Is  seriously  considering  the  deletion  of  putty  on  the  fJM- 
S  notile/case  joint  since  they  believe  the  putty  Is  tne  prlae 
cause  of  the  erosion.   A  decision  on  this  change  Is  planned  to  be 
aade  this  week.   I  have  reservations  about  doing  It,  considering 
the  significance  of  the  QM-S  firing  la  qualifying  the  FMC  for 
flight. 


It  Is  laportant  to  note  thet  the  cause  and  effect  of  the  putty 
varies.  There  are  soae  MSFC  personnel  who  ere  aot  coevlnced  that 
the  holes  In  the  putty  are  the  aource  of  the  problea  but  feel 
that  it  aay  be  e  reverse  effect  In  thet  the  hot  gates  aiv  be 
leaking  through  the  seel  and  causing  the  holt  trick  In  tht  putty. 

Considering  the  feet  thtt  thtrt  dotsn't  tppetr  to  bt  t  vtlldtttd 
resolution  as  to  the  effect  of  putty,  I  would  certainly  questloa 
the  altdoa  In  reaovlng  it  on  QM-t. 

i.   Cast  to  Cttt  "0"  Ring  Brotloa 

There  htve  been  five  (S)  occurrences  during  flight  where  there 
wis  prlatry  field  joint  "0"  ring  erosion.   There  was  one  cttt 
where  the  tecondtry  "0"  ring  wtt  htet  tfftcttd  with  no  trotlon. 
The  erosion  with  the  field  joint  prlatry  "0"  rings  is  consldtrtd 
by  toae  to  be  aore  critical  than  the  notzle  joint  due  to  the  fact 
that  during  the  pressure  build  up  on  the  prlaary  "0"  ring  the 
unpresiurlied  field  joint  ttcondtry  tttl  unstttt  dut  to  joint 
rotation. 

The  problea  with  the  unseetlng  of  the  ttcondtry  "0"  ring  during 
joint  rotttlon  his  been  known  for  quite  soae  tlae.   In  order  to 
ellalnste  this  problea  on  the  FIT  field  joints  t  cipture  fetturt 
wis  designed  which  prevents  the  secondary  tell  froa  lifting 
off.   During  our  discussions  on  this  Issue  with  MSFC,  in  tction 
wis  tsslgned  for  thea  to  idtntlfy  tht  tiling  tssoclittd  with  tht 
unletting  of  the  tecondtry  "0"  ring  end  the  letting  of  tht 
prlatry  "0"  ring  during  rotttlon.   Now  long  It  tikes  the 
secondary  "0"  ring  to  lift  off  during  rotttlon  ind  when  In  the 
pressure  cycle  it  lifts  trt  kty  ftctort  In  tht  dtttralnttlon  of 
ltt  crltlctllty. 

The  prtsent  consensus  Is  thit  if  the  prlatry  "0"  ring  tilts 
during  Ignition,  ind  subsequently  fills,  the  unseated  tecondtry 
"0"  ring  will  not  serve  Its  Intended  purpose  ts  t  redundint 
seel.   However,  redundancy  does  tiist  during  tht  Ignition  cycle, 
which  is  the  aost  critlctl  tlat. 

It  Is  recoaaended  thtt  we  irrtnge  for  MSFC  to  provide  in  ovenll 
briefing  to  you  on  the  SRM  "0"  rings,  Including  failure  history, 
current  stttus,  ind  optlont  for  corrtcting  tht  probltas. 

Irving  Dtvldt 

cc: 

M/Mr.  Weeks 
M/Mr.  Haaby 
ML/Mr.  Htrrlngton 
MP/Mr.  Wlntorheltor 


This  memorandum  to  Level  I  describes  a  visit  to  Marshall  by 
Irving  Davids  of  NASA  Headquarters  Davids'  visit  was 
prompted  by  the  nozzle  O-nng  problems  suffered  on  STS 
51 -B  (flight  17). 
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Thiokol  letters  and  memoranda  written  after  O-ring  concern  escalates 


Morton  Thiokol  Inc 

Wasatch  Division 


COHPANY  PRIVATZ 


Interoffice  Memo 


31   July   1985 
2870:FY86:073 

TO: 


CC: 

FROM: 

SCTBJECT: 


R.    JC.   Lund 

Vice  President,    Engineering 

B.    C.    Brinton,   A.   J.   McDonald,  L.   H.   Sayer,  J.  R.   Kapp 

R.  M.  Boisjoly 

Applied  Mechanics  -  Ext.  3525 

SRM  O-Riug  Erosion/Potential  Failure  Criticality 


This  letter  is  vritten  to  insure  that  management  is  fully  aware  of  the 
seriousness  of  the  current  O-Ring  erosion  problem  in  the  SRM  joints  from  an 
engineering  standpoint. 

The  mistakenly  accepted  position  on  the  Joint  problem  was  to  fly  without  fear 
of  failure  and  to  run  a  series  of  design  evaluations  which  would  ultimately 
lead  to  a  solution  or  at  least  a  significant  reduction  of  the  erosion  problem. 
This  position  is  now  drastically  changed  as  a  result  of  the  SRM  16A  nozzle 
joint  erosion  which  eroded  a  secondary  O-Ring  with  the  primary  O-Ring  never 
sealing. 

If  the  same  scenario  should  occur  in  a  field  joint  (and  it  could),  then  it  is 
a  jump  ball  as  to  the  success  or  failure  of  the  joint  because  the  secondary 
0—  Ring  cannot  respond  to  the  clevis  opening  rate  and  may  not  be  capable  of 
pressurization.  -The  result  would  be  a  catastrophe  of  the  highest  order  - 
loss  of  human  life. 

An.  unofficial  team  (a  memo  defining  the  team  and  its  purpose  was  never 
published)  with  leader  was  formed  on  19  July  1985  and  was  tasked  with  solving 
the  problem  for  both  the  short  and  long  term.   This  unofficial  team  is 
essentially  nonexistent  at  this  time.   In  my  opinion,  the  team  must  be 
officially  given  the  responsibility  and  the  authority  to  execute  the  work. 
that  needs  to  be  done  on  a.   non-interference  basis  (full  time  assignment  until 
completed). 
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Roger  Boisjoly's  first  attempt  after  STS  51 -B  (flight  17)  to  con- 
vince his  management  of  the  seriousness  of  the  0-rmg  erosion 
problem. 
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R.   K.  Lund 


31  July   1985 


It   la  my  honest  and  very  real  fear   that  If  we  do  not  take  immediate  action  to 
dedicate  a  team  to  aolve   the  problem     with  the  field  joint  having  the  number 
one  priority,    then  we  stand  in  Jeopardy  of  losing  a  flight  along  with  all  the 
launch  pad  facilities. 


ty<& 


R.  M.  Boisjoly 
Concurred  by 

Kapp,  Manger 
ed  Mechanics 


COMPANY  PKIVATE 


page  2 
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Morton  Thiokol  Inc 


Wasatch  Division 


Interoffice  Memo 


2871:FY86:141 
22  August  1985 


TO: 


CC: 


FROM: 


S.R.  Stein, 
Project  Engineer 

J.R.  Kapp,  K.M.  Sperry,  B.G.  Russell,  R.V.  Ebeling,  H.H.  Mcintosh, 
R.M.  Boisjoly,  M.  Salita  D.M.  Ketner 

A.R.  Thompson,  Supervisor 
Structures  Design 


SUBJECT:   SRM  Flight  Seal  Recommendation 


The  O-ring  seal  problem  has  lately  become  acute  .   Solutions,  both  long  and 
short  term  are  being  sought,  in  the  mean  time  flights  are  continuing.   It  is 
my  recommendation  that  a  near  term  solution  be  incorporated  for  flights 
following  STS-27  which  is  currently  scheduled  for  24  August  1985.   The  near 
term  solution  uses  the  maximum  possible  shim  thickness  and  a  .292  +.005/-. 003 
inch  dia  0— ring.   The  results  of  these  two  changes  are  shown  in  Table  1.   A 
great  deal  of  effort  will  be  required  to  incorporate  these  changes.   However, 
as  shown  in  the  Table  the  0-ring  squeeze  is  nearly  doubled  for  the  example 
(STS-27A).   A  best  effort  should  be  made  to  include  a  max  shim  kit  and  the 
.292  dia  0-ring  as  soon  as  is  practical.   Much  of  the  initial  blow-by  during 
0-ring  sealing  is  controlled  by  0-ring  squeeze.  Also  more  sacrificial  0-ring 
material  is  available  to  protect  the  sealed  portion  of  the  0-ring.   The  added 
cross-sectional  area  of  the  .292  dia  0-ring  will  help  the  resilience  response 
by  added  pressure  from  the  groove  side  wall. 

Several  long  term  solutions  look  good;  but,  several  years  are  required  to 
incorporate  some  of  them.   The  simple  short  term  measures  should  be  taken  to 
reduce  flight  risks. 


A.R.  Thompson 
ART/jh 


TC  3018  IBEV  7-Ml 


In  this  memorandum  to  S.R.  Stein,  A.R.  Thompson  indicates 
the  O-nng  seal  problem  is  acute  and  short-term  measures 
should  be  taken  to  reduce  flight  risk. 
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Morton  TIhiokolInc 


Wasatch  Division 


InUrofllc*  Memo 


1  October  1965 
E1S0/RVE-86-47 


TO:         A.  J.  HcOonald,  Director 
Solid  Rocket  Motor  Project 

FROM:         Manager,  SRM  Ignition  System,  Final  Assembly,  Special 
Projects  and  Ground  Test 

CC:  B.  McDougall,  B.  Russell,  J.  McCluskey,  0.  Cooper, 

J.  Kllmlnster,  B.  Brlnton,  T.  O'Grady,  B.  MacBeth, 
J.  Sutton,  J.  Elwell.  I.  Adams,  F.  Call,  J.  Lamere, 
P.  Ross,  0.  Fullmer,  E.  Bailey,  0.  Smith,  I.  Bailey, 
B.  kuchek,  Q.  Eskelsen,  P.  Petty,  J.  McCall 

SUBJECT:      Weekly  Activity  Report 
1  October  1985 


EXECUTIVE  SUMMARY 

HELPI  The  seal  task  force  Is  constantly  being  delayed  by  every  possible 
means.  People  are  quoting  policy  and  systems  without  work-around.  MSFC 
Is  correct  In  stating  that  we  do  not  know  how  to  run  a  development 
program. 

GROimO  TEST 

1.  The  two  (2)  GTM  center  segments  were  received  at  T-24  last  week. 
Optical  measurements  are  being  taken.   Significant  work  has  to  be  done 
to  clean  up  the  Joints.  It  should  be  noted  that  when  necessary  SICBM 
takes  priority. 

2.  The  DM-6  test  report  less  composite  section  was  released  last  week. 
ELECTRICAL 

As  a  result  of  the  latest  engineering  analysis  of  the  V-l  case  It 

appears  that  high  stress  risers  to  the  case  are  created  by  the  phenolic 
OFI  housings  and  fairings.  As  It  presently  stands,  these  will  probably 
have  to  be  modified  or  removed  and  If  removed  will  have  to  be  replaced. 
This  could  have  an  Impact  on  the  launch  schedule. 


A.  J.  McDonald,  Director 
1  October  1985 
E150/RVE-86-A7 
Page  2 


FINAL  ASSEMBLY 


One  SRM  25  and  two  SRM  26  segments  along  with  two  SRM  24  exit  cones  were 
completed  during  this  period.  Only  three  segments  are  presently  in 
work.  Availauility  of  Igniter  components,  nozzles  and  systems  tunnel 
tooling  are  the  present  constraining  factors  In  the  final  assembly  area. 

IGNITION  SYSTEM 

1.  Engineering  is  currently  rewriting  igniter  gask-o-seal  coating 
requirements  to  allow  minor  flaws  and  scratches.  Bare  metal  areas  will 
be  coated  with  a  thin  film  of  HD-2  grease.  Approval  is  expected  within 
the  week. 

2.  Safe  and  Arm  Device  component  deliveries  is  beginning  to  cause 
concern.  There  are  five  SSA's  at  KSC  on  the  shelf.  Procurement, 
Program  Office  representatives  visited  Consolidated  Controls  to  discuss 
accelerating  scheduled  deliveries.  CCC  has  promised  10  A&H's  and  30 
B-B's  no  later  than  31  October  1985. 

0-RINGS  AND  PUTTY 

1.  The  short  stack  finally  went  together  after  repeated  attempts,  but 
or.e  of  the  o-rings  was  cut.  Efforts  to  separate  the  joint  were  stopped 
because  some  do  not  think  they  will  work.  Engineering  1s  designing 
tools  to  separate  the  pieces.  The  prints  should  be  released  tomorrow. 

2.  The  inert  segments  are  at  T-24  and  are  undergoing  inspection. 

3.  The  hot  flow  test  rig  is  In  design,  which  is  proving  to  be 
difficult.  Engineering  1s  planning  release  of  these  prints  Wednesday  or 
Thursday. 

4.  Various  potential  filler  materials  are  on  order  such  as  carbon, 
graphite,  quartz,  and  silica  fiber  braids;  and  different  putties.  They 
will  all  be  tried  in  hot  flow  tests  and  full  scale  assembly  tests. 

5.  The  allegiance  to  the  o-ring  investigation  task  force  is  very 
limited  to  a  group  of  engineers  numbering  8-10.  Our  assigned  people  in 
manufacturing  and  quality  have  the  desire,  but  are  encumbered  with  other 
significant  work.  Others  in  manufacturing,  quality,  procurement  who  are 
not  involved  directly,  but  whose  help  we  need,  are  generating  plenty  of 
resistance.  We  are  creating  more  instructional  paper  than  engineering 
data.  We  wish  we  could  get  action  by  verbal  request  but  such  1s  not  the 
case.  This  is  a  red  flag. 


R.  V.  Ebelinq 


In  this  weekly  activity  report.  Robert  Ebeling  attempts  ("Help!") 
to  draw  management  attention  to  the  difficulties  experienced 
by  the  seal  task  force  in  getting  adequate  support,  indicating 
This  is  a  red  flag." 
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Morton  Thiokol  Inc 


Wasatch  Operations 


Interoffice  Memo 


1   October  1985 
0RTF-FY3C-H002 


R.   K.   Lund,   Vice  President,   Engineering 
A.  J.   McDonald,   Director,   Space  Booster  Programs 
6.    C.   Brinton,   Manager,   Project  Engineering 
A.   W.   NacBeth,   Manager,   Project  Engineering 
O-Ring  Investigation  Task  Force  Members 

S.   R.   Stein 

Space  Booster  Project  Engineering 

Potency  of  O-Ring  Investigation  Task  Force 


The  task  force  for  investigation  of  0-ring  erosion  and  related  joint  problems 
has  now  existed  for  more  than  a  month.     We  are  finally  getting  enough  people 
aware  of  our  efforts  so   that   in  some  areas  we  are   receiving   full   cooperation. 
In   other  areas   however,    it   is   truly  a   struggle   to  get  work   performed.      The 
QM-5  firing,   VLS-1   launch,  and  safety  of  every  other  shuttle  launch  are  all 
directly  related   to   the  work   currently  underway.      Unless   drastic   imorovements 
in   the  potency  of   the   task   force   are   realized,    the   time   required   to  complete 
the  necessary  Investigations,   testing,   and  analytical  work  will   not  supoort 
a  desirable  schedule. 

We  are  currently  being  hog-tied  by  paperwork  every   time  we   try  to  accomplish 
anything.      I   understand   that   for  production  programs,    the  paperwork   is 
necessary.      However,    for  a   priority,   short  schedule   investigation,    it  makes 
accomplishment  of  our  goals   in  a    timely  manner  extremely  difficult,    if  not 
impossible.     We  need  the  authority  to  bypass   some  of  the  paperwork  jungle. 
As  a  representative  example  of  problems  and  time  that  could  easily  be 
eliminated,   consider  assembly  or  disassembly  of  test  hardware  by  manufacturing 
personnel . 

Currently  an  AO  must  be  generated,  which   triggers   the  manufacturing  engineer 
to  generate  detailed  planning.     Once   the  planning  is   released,  we  must  go  to 
scheduling,   who  puts  us   on   the   list  of  priority  work   to  do.     We   then  wait 
until   our  job  reaches   the   top  of   the   list,   and  a  crew  begins   the  work.      If 
any  problems  arise,  we  get  tangled  in  more  paperwork.      In  recent  operations, 
we  have  had  full  cooperation  from  all   involved  oarties,  but  getting  all    the 
procedures   lined  up  takes  too  long.     We  need  the  authority  to  have  a  "team" 
formed  which  could  include  a  Design  Engineer,  Manufacturing  Engineer,  Quality 
Engineer,  Safety  Engineer,  and  the  Foreman.     The  crew  should  perform  the  work 
as  directed  by  the   team.     Paperwork   to  describe  each  step  in  detail   should 
not  be  necessary.     The  team  engineers  should  be  allowed  to  take  responsibility 
for  the  work. 


Distribution 
1   October  1985 
Page  two 


I   know  the  established  paperwork  procedures  can  be  violated  if  someone  with 
enough  authority  dictates   it.     We  did   that  with   the  OR  system  when   the  FWC 
hardware   "Tiger  Team"  was  established.      If  changes   are  not  made   to  allow 
us  to  accomplish  work   in  a  reasonable  amount  of  time,   then  the  0-rlng  Inves- 
tigation task  force  will   never  have  the  potency  necessary  to  resolve  the 
problems   in  a   timely  manner. 


S.R.  Stem  echoes  the  concerns  about  the  seal  task  force  not 
getting  full  support. 
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ACTIVITY  REPORT 


The  team  generally  has  been  experiencing  trouble  from  the  business 
as  usual  attitude  from  supporting  organizations.  Part  of  this  is  due  to 
lack  of  understanding  of  how  important  this  task  team  activity  is  and 
the  rest  is  due  to  pure  operating  procedure  Inertia  which  prevents 
timely  results  to  a  specific  request. 

The  team  met  with  Joe  Kilminster  on  10/3/85  to  discuss  this 
problem.   He  wanted  specific  examples  which  he  was  given  and  he  simply 
concluded  that  "it  was  every  team  members  responsibility "to  flag  problems 
that  occurred  to  organizational  supervision  and  work  to  remove  the  road 
block  by  getting  the  required  support  to  solve  the   problem.  The  problem 
was  further  explained  to  require  almost  full  time  nursing  of  each  task 
to  insure  it  is  taken  to  completion  by  a  support  group.  Joe  simply 
agreed  and  said  we  should  then  nurse  every  task  we  have. 

He  plain  doesn't  understand  that  there  are  not  enough  people  to  do 
that  kind  of  nursing  of  each  task,  but  he  doesn't  seem  to  mind  directing 
that  the  task  never—  the-less  gets  done.   For  example,  the  team  just 
found  out  that  when  we  submit  a  request  to  purchase  an  item,  that  it 
goes  through  approximately  6  to  8  people  before  a  purchase  order  is 
written  and  the  item  actually  ordered. 

The  vendors  we  are  working  with  on  seals  and  spacer  rings  have 
responded  to  our  requests  In  a  timely- manner  yet  we  (MTI)  carrot  get  a 
purchase  order  to  them  in  a  timely  manner.   Our  lab  has  been  waiting  for 
a  function  generator  since  9-25-85.   The  paperwork  authorizing  the 
purchase  was  finished  by  engineering  on  9-24-85  and  placed  into  the 
system.   We  have  yet  to  receive  the  requested  item.   This  type  of 
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In  this  activity  report,  Roger  Boisjoly  expresses  his  frustration 
with  the  slow  progress  of  and  lack  of  management  attention  to 
the  seal  task  force. 
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example  is  typical  and  results  in  lost  resources  that  had  been  planned 
to  do  test  work  for  us  in  a  timely  manner. 

I  for  one  resent  working  at  full  capacity  all  week  long  and  then 
being  required  to  support  activity  on  the  weekend  that  could  have  been 
accomplished  during  the  week.   I  might  add  that  even  NASA  perceives  that 
the  team  is  being  blocked  in  its  engineering  efforts  to  accomplish  its 
tasks.  NASA  is  sending  an  engineering  representative  to  stay  with  us 
starting  Oct  14th.  We  feel  that  this  is  the  direct  result  of  their 
feeling  that  we  (MTI)  are  not  responding  quickly  enough  on  the  seal 
problem. 

I  should  add" that  several  of  the  team  members  requested  that  we  be 
given  a  specific  manufacturing  engineer,  quality  engineer,  safety 
engineer  and  A  to  6  technicians  to  allow  us  to  do  our  tests  on  a 
non-interference  basis  with  the  rest  of  the  system.  This  request  was 
deemed  not  necessary  when  Joe  decided  that  the  nursing  of  the  task 
approach  was  directed. 

Finally,  the  basic  problem  boils  down  to  the  fact  that  ALL  Mil 
problems  have  4l   priority  and  that  upper  management  apparently  feels 
that  the  SUM  program  is  ours  for  sure  and  the  customer  be  dammed. 


Roger  Boisjoly  /off  /££ 
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Marshall  internal  memorandum  in  the  fall  of  1985 


O*/0v*C  ">j< 


George  C.  Marshall  Space  Right  Center 
Marshall  Space  Flight  Center.  Alabama 
35812 


EA01 

TO:  SAUl/L.  M.  Mulloy 

FROM:  EA01/J.  E.  Kingsbury 

SUBJECT:  O-ring  Joint  Seals 
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Science  and  Engineering 


cc  : 

SA01/Mr.  Lindstrom 

SA01/Dr;  Lovingood 

EA01/Mr.  Hardy 
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In  this  memorandum,  J.  E  Kingsbury  informs  Lawrence 
Mulloy  that  he  places  high  priority  on  the  0-nng  seal  problem 
and  desires  additional  information  on  plans  for  improving  the 
situation. 
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